CVE-2026-74474 (GCVE-0-2026-74474)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-09-14 11:58
VLAI
EPSS
VEX
Title
vxlan: use pskb_network_may_pull() for transmit path header pulls
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() for transmit path header pulls
In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was
being called to verify the availability of network layer headers (ARP, IPv6/ND,
IP/IPv6 MDB keys).
However, during transmit skb->data points to the MAC header, so skb_network_offset(skb)
is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data
rather than skb_network_offset(skb) + len, which can leave part of the network header
in non-linear frags.
Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly
account for the MAC header offset.
Severity
9.8 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
e4f67addf158f98f8197e08974966b18480dc751 , < 371425d4be7795e9158388af9eee0201e6047410
(git)
Affected: e4f67addf158f98f8197e08974966b18480dc751 , < bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 6146901881f09ef063eb34ad389f63231f8486f5 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 94dee751aad627b3645d424b5d0c736d394573e9 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < 7076a34b6e33315dc160b4612bfea1c597495585 (git) Affected: e4f67addf158f98f8197e08974966b18480dc751 , < b9553558b48db54ac9273e6b98d7263ef5c1a329 (git) |
guessed | |
| Linux | Linux |
Affected:
3.8
Unaffected: 0 , < 3.8 (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "371425d4be7795e9158388af9eee0201e6047410",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "6146901881f09ef063eb34ad389f63231f8486f5",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "94dee751aad627b3645d424b5d0c736d394573e9",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "7076a34b6e33315dc160b4612bfea1c597495585",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "b9553558b48db54ac9273e6b98d7263ef5c1a329",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb-\u003edata points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb-\u003edata\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in VXLAN transmit handling reached when overlay/bridged traffic is sent through a VXLAN netdev; remote peers on cloud/Kubernetes/OpenStack overlay networks can inject ARP, ND, or multicast frames that traverse vxlan_xmit without local shell access.\nAC:L - Once a VXLAN device has proxy or MDB enabled, an attacker can reliably craft non-linear sk_buff frames (fragmented payloads with headers split across head/frags) to pass the undersized pskb_may_pull check and trigger out-of-bounds header reads.\nPR:N - Exploitation requires only the ability to send L2/L3 traffic on an existing VXLAN overlay; no host credentials, root, or CAP_NET_ADMIN on the victim are needed because any unauthenticated remote tenant VM, pod, or overlay peer can forward triggering frames into the transmit path.\nUI:N - No victim user action is required; the kernel processes attacker-supplied network frames automatically during normal overlay bridging and VXLAN encapsulation.\nS:U - Impact is confined to the kernel network stack on the affected host; it does not cross a VM, container, or hypervisor security boundary into a different authority.\nC:H - Undersized pskb_may_pull allows direct network-header pointer access past skb_headlen into non-linear frags or adjacent kernel memory, constituting an out-of-bounds kernel read capable of disclosing sensitive heap or packet-buffer contents.\nI:H - Out-of-bounds parsed ARP, ND, and IP header fields drive proxy neighbour replies and MDB multicast forwarding decisions, letting an attacker influence overlay neighbour resolution and traffic redirection on the victim node.\nA:H - Out-of-bounds header access in the atomic VXLAN transmit path can cause kernel oops or panic, and an unauthenticated remote attacker can trigger this repeatedly for denial of service against VXLAN-enabled infrastructure nodes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:58:47.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/371425d4be7795e9158388af9eee0201e6047410"
},
{
"url": "https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4"
},
{
"url": "https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5"
},
{
"url": "https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9"
},
{
"url": "https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585"
},
{
"url": "https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329"
}
],
"title": "vxlan: use pskb_network_may_pull() for transmit path header pulls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74474",
"datePublished": "2026-08-15T12:27:10.037Z",
"dateReserved": "2026-08-15T05:44:03.903Z",
"dateUpdated": "2026-09-14T11:58:47.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74474",
"date": "2026-10-01",
"epss": "0.00721",
"percentile": "0.52229"
},
"microsoft_vex": {
"current_release_date": "2026-09-23T01:56:55.000Z",
"cve": "CVE-2026-74474",
"id": "msrc_CVE-2026-74474",
"initial_release_date": "2026-08-23T14:56:52.000Z",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "vxlan: use pskb_network_may_pull() for transmit path header pulls",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74474.json",
"version": "3"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "371425d4be7795e9158388af9eee0201e6047410",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "6146901881f09ef063eb34ad389f63231f8486f5",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "94dee751aad627b3645d424b5d0c736d394573e9",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "7076a34b6e33315dc160b4612bfea1c597495585",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
},
{
"lessThan": "b9553558b48db54ac9273e6b98d7263ef5c1a329",
"status": "affected",
"version": "e4f67addf158f98f8197e08974966b18480dc751",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c",
"drivers/net/vxlan/vxlan_mdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb-\u003edata points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb-\u003edata\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."
}
],
"id": "CVE-2026-74474",
"lastModified": "2026-09-14T12:17:45.980",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-15T13:17:52.177",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/371425d4be7795e9158388af9eee0201e6047410"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-21T08:53:22+00:00",
"cve": "CVE-2026-74474",
"id": "CVE-2026-74474",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: vxlan: use pskb_network_may_pull() for transmit path header pulls",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74474.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-22T16:35:56Z",
"cve": "CVE-2026-74474",
"id": "CVE-2026-74474",
"initial_release_date": "2026-08-15T23:52:14Z",
"product_status:first_fixed": "60",
"product_status:known_affected": "715",
"product_status:known_not_affected": "4",
"product_status:recommended": "107",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-74474",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74474.json",
"version": "14"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…