CVE-2026-74475 is a race condition in the Linux kernel's neighbor subsystem where route_shortcircuit() reads a hardware address (n->ha) without holding the required seqlock, allowing an attacker to observe stale data. The fix already exists: use neigh_ha_snapshot() instead of direct n->ha access. This is a pattern-application failure, not a pattern-discovery problem—the kernel community built this safe utility precisely because this race class is known.
Patch route_shortcircuit() immediately. But the CVE text explicitly flags arp_reduce() and neigh_reduce() as having 'the same issue left for future patches.' Treat this as a two-for-one: when you patch the reported function, proactively audit and patch the sister functions in the same code path. Attackers will read this CVE and see the roadmap.
The CVSS 10 with EPSS 0.00399 signals a narrow but real exploitation window. The attack requires triggering route_shortcircuit() through VXLAN traffic with precise timing—a high bar, but not an impossible one. The low EPSS reflects pre-disclosure probability; once this publishes, the class of similar race conditions in the neighbor subsystem becomes active reconnaissance terrain.
Audit neigh.c and vxlan.c for any other n->ha accesses outside seqlock protection. The pattern is simple: if you're reading n->ha and not using read_seqbegin_or_retry, you're likely vulnerable. The kernel has the safe API—your job is finding everywhere it isn't being used.