The vulnerability (CVE-2026-74615) in the Linux kernel VXLAN driver arises because vxlan_changelink() arms the ageing timer without verifying if the device is running (missing netif_running() check). If the device is down and subsequently freed, the timer remains queued and later executes, causing a use-after-free error in kernel memory. This occurs because the timer is armed on a device that was never brought up, and the synchronous timer cancellation in vxlan_stop() is skipped for devices without IFF_UP. The issue can be triggered by unprivileged users within new user and network namespaces due to the netns-scoped rtnl operations involved. The fix adds the missing netif_running() test to prevent arming the timer on down devices.

The vulnerability leads to a kernel use-after-free condition, which can cause kernel crashes or undefined behavior. Since the operations are network namespace scoped and accessible to unprivileged users in their own namespaces, it may allow local unprivileged users to trigger kernel memory corruption. No information about remote exploitation or privilege escalation is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves adding a netif_running() check before arming the ageing timer on VXLAN devices. Until a patch is applied, avoid creating or modifying VXLAN devices in a way that triggers this condition, especially in unprivileged network namespaces.