CVE-2026-74615: Linux Kernel Use-After-Free in VXLAN Ageing Timer

Changing the ageing interval on a VXLAN device arms its ageing timer without checking whether the device is up. The only synchronous cancel lives in the stop handler, which never runs for a device that was never brought up. Deleting that device frees the structure the timer lives in while the timer is still queued.

When the timer fires, the timer core writes through the freed object's list pointers. The netlink operations involved are namespace-scoped, so an unprivileged user can reach them from a fresh user and network namespace. The CVE carries a CVSS score of 8.8. The fix adds the missing running check.