GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74684 (GCVE-0-2026-74684)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 924a9bc362a5223cd448ca08c3dde21235adc310 , < 15583b07fd691a844fbf7b3ad612cdc9e9a657c0 (git)
Affected: 924a9bc362a5223cd448ca08c3dde21235adc310 , < 8b444b126cd8e4473e652f529753ed4dd1360a9c (git)
Affected: 924a9bc362a5223cd448ca08c3dde21235adc310 , < 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b (git)
Affected: 924a9bc362a5223cd448ca08c3dde21235adc310 , < 3874892dd27d5387aa9a06f58d9060f18f351d24 (git)
Affected: ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d (git)
Affected: 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 (git)
Affected: ca278267d6cd9544645731732455b6b20cb0e895 (git)
Affected: faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 (git)
Affected: 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 (git)
Affected: 4.14.226 , < 4.15 (semver)
Affected: 4.19.181 , < 4.20 (semver)
Affected: 5.4.106 , < 5.5 (semver)
Affected: 5.10.24 , < 5.11 (semver)
Affected: 5.11.7 , < 5.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15583b07fd691a844fbf7b3ad612cdc9e9a657c0",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "8b444b126cd8e4473e652f529753ed4dd1360a9c",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "lessThan": "3874892dd27d5387aa9a06f58d9060f18f351d24",
              "status": "affected",
              "version": "924a9bc362a5223cd448ca08c3dde21235adc310",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54ef8243c3c8e90f1ea5792e6752e021a25c8eb3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca278267d6cd9544645731732455b6b20cb0e895",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "faa3baa2828c5e1c4374f3e60041f75c64f5fcb6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.226",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.181",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.106",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.106",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()\n\nThe commit 4f61f133f354 (\"net: tap: NULL pointer derefence in\ndev_parse_header_protocol when skb-\u003edev is null\") fixed a crash in\ntap_get_user() by assigning skb-\u003edev before calling tun_vnet_hdr_to_skb().\nThis is required because virtio_net_hdr_to_skb() may invoke\ndev_parse_header_protocol(), which dereferences skb-\u003edev. Without the\nassignment, a NULL pointer dereference can occur.\n\nHowever, tap_get_user_xdp() still parses the virtio-net header before\nassigning skb-\u003edev. When the vhost TX path passes an XDP buffer containing\na GSO virtio-net header but the protocol is set to zero on purpose,\ntun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb-\u003edev\nis still NULL, resulting in a crash.\n\nFix this by looking up the tap device and assigning skb-\u003edev before calling\ntun_vnet_hdr_to_skb(), matching the ordering already used in\ntap_get_user(). Preserve the existing RCU read-side critical section across\ndev_queue_xmit()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious KVM guest reaches tap_get_user_xdp() by kicking the virtio-net TX virtqueue; vhost_net handle_tx_copy batches XDP buffers and invokes tap_sendmsg(TUN_MSG_PTR), not via any host network packet-receive path.\nAC:L - On typical QEMU/KVM vhost-net+tap/macvtap backends with TX batching enabled, a guest fully controls virtio-net GSO headers and Ethernet frames; sending GSO with ethertype 0 deterministically hits dev_parse_header_protocol() with skb-\u003edev NULL without races.\nPR:N - No host root or capabilities are required; a malicious cloud VM tenant only needs code execution inside a guest using virtio-net with a vhost-net tap backend, matching other guest-to-host virtio/KVM CNA scores.\nUI:N - No separate victim action is needed; the attacker submits crafted virtio-net TX descriptors from their own guest workload during normal VM operation without requiring host administrator interaction.\nS:C - Guest-supplied virtio-net TX data triggers a NULL pointer dereference in host tap_get_user_xdp(), panicking the physical host kernel and crossing the KVM guest-to-host virtualization security boundary.\nC:N - The failure mode is a NULL pointer dereference at dev-\u003eheader_ops with skb-\u003edev unset; there is no demonstrated out-of-bounds read, use-after-free, or other memory corruption that could disclose host kernel data.\nI:N - No guest-controlled host memory write or control-flow hijack occurs; the host kernel oopses on the NULL dereference before any exploitable modification beyond the immediate crash.\nA:H - The NULL pointer dereference in dev_parse_header_protocol() provokes a host kernel oops/panic in the vhost worker during guest virtio-net TX, denying availability of the hypervisor and all co-resident VMs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:30.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15583b07fd691a844fbf7b3ad612cdc9e9a657c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24"
        }
      ],
      "title": "net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74684",
    "datePublished": "2026-08-22T15:32:50.846Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:30.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74684",
      "date": "2026-09-16",
      "epss": "0.00138",
      "percentile": "0.0358"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:51:33.000Z",
      "cve": "CVE-2026-74684",
      "id": "msrc_CVE-2026-74684",
      "initial_release_date": "2026-08-24T01:08:47.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74684.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74684\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:42.757\",\"lastModified\":\"2026-08-25T06:18:51.253\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()\\n\\nThe commit 4f61f133f354 (\\\"net: tap: NULL pointer derefence in\\ndev_parse_header_protocol when skb-\u003edev is null\\\") fixed a crash in\\ntap_get_user() by assigning skb-\u003edev before calling tun_vnet_hdr_to_skb().\\nThis is required because virtio_net_hdr_to_skb() may invoke\\ndev_parse_header_protocol(), which dereferences skb-\u003edev. Without the\\nassignment, a NULL pointer dereference can occur.\\n\\nHowever, tap_get_user_xdp() still parses the virtio-net header before\\nassigning skb-\u003edev. When the vhost TX path passes an XDP buffer containing\\na GSO virtio-net header but the protocol is set to zero on purpose,\\ntun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb-\u003edev\\nis still NULL, resulting in a crash.\\n\\nFix this by looking up the tap device and assigning skb-\u003edev before calling\\ntun_vnet_hdr_to_skb(), matching the ordering already used in\\ntap_get_user(). Preserve the existing RCU read-side critical section across\\ndev_queue_xmit().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/tap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"924a9bc362a5223cd448ca08c3dde21235adc310\",\"lessThan\":\"15583b07fd691a844fbf7b3ad612cdc9e9a657c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"924a9bc362a5223cd448ca08c3dde21235adc310\",\"lessThan\":\"8b444b126cd8e4473e652f529753ed4dd1360a9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"924a9bc362a5223cd448ca08c3dde21235adc310\",\"lessThan\":\"164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"924a9bc362a5223cd448ca08c3dde21235adc310\",\"lessThan\":\"3874892dd27d5387aa9a06f58d9060f18f351d24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54ef8243c3c8e90f1ea5792e6752e021a25c8eb3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca278267d6cd9544645731732455b6b20cb0e895\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faa3baa2828c5e1c4374f3e60041f75c64f5fcb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.226\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.181\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.106\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.24\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.7\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/tap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/15583b07fd691a844fbf7b3ad612cdc9e9a657c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:54:11+00:00",
      "cve": "CVE-2026-74684",
      "id": "CVE-2026-74684",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74684.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:16:41Z",
      "cve": "CVE-2026-74684",
      "id": "CVE-2026-74684",
      "initial_release_date": "2026-08-25T01:19:18Z",
      "product_status:known_affected": "264",
      "product_status:known_not_affected": "89",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74684",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74684.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.