A timer could fire after a virtual tunnel was already torn down
Brief
This is the ageing-timer hole, not the changelink namespace one.
Notes
b37971686ec59fb027fa4910ba16805e68fddb97 (Baul Lee, 2026-08-11). Do not arm the ageing timer on a device that is down. The old path could fire a timer write through a freed vxlan device. Fixes: and Cc: stable. Use-after-free. The commit does not say local privilege escalation. Not in 7.1.8 (tagged 2026-08-09). Different SHA from the changelink namespace bug.
Commit b37971686ec59fb027fa4910ba16805e68fddb97