CVE intelligence

CVE-2026-74475

Vulnerability intelligence

Published Aug 15, 2026Sources checked Oct 28, 2026

10.0CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-74475 and is rated Critical severity with a CVSS score of 10.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 2, 2026

Release Notes

Vendor-listed releases

6.6.152.1-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-74475?

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address.

Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it.

Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

Source: NVD