CVE-2026-90105

Not scored yetLast modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: fix reading neigh ha

Currently arp/neigh_reduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address similar to route_shortcircuit which already does the right thing.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e4f67addf158f98f8197e08974966b18480dc751, < a1e86c5b4463178751a9fd3f0a3876a602dc360c; >= e4f67addf158f98f8197e08974966b18480dc751, < 6093baf2b2c57e7da33bacd2223570a78b416d89; >= e4f67addf158f98f8197e08974966b18480dc751, < 751cb520f9e47538b7223df133806a29fc41f54f; >= e4f67addf158f98f8197e08974966b18480dc751, < f43ef9a3f9c121472a0754c9e9bff13317ace0f7; >= e4f67addf158f98f8197e08974966b18480dc751, < ecc8bac11a101e5f6989a14b92e17b51f9761630; >= e4f67addf158f98f8197e08974966b18480dc751, < b824059a673b2283e78c7aae2c7d257aad7f0e1d
LinuxLinux3.8

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90106In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha addCVE-2026-90107In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smc_llc_flow_stop() before memset smc_CVE-2026-90108In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LICVE-2026-90109In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue grCVE-2026-90117.5The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, anCVE-2026-901109.4In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeerCVE-2026-901117.8In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mr_cache_report() IPv6 input attaches a CVE-2026-90112In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified CVE-2026-90113In the Linux kernel, the following vulnerability has been resolved: netdevsim: update queue NAPI association on queue reset In netdevsim, CVE-2026-90114In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descendingCVE-2026-90115In the Linux kernel, the following vulnerability has been resolved: xsk: fix NULL pointer dereference in __xsk_rcv() In the __xsk_rcv() muCVE-2026-90116In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown snd_mtpav_out
CVE-2026-90105: Unscored | Vulnix