CVE-2026-74744 (GCVE-0-2026-74744)
Vulnerability from cvelistv5 – Published: 2026-08-26 14:36 – Updated: 2026-08-27 05:01
VLAI
EPSS
VEX
Title
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),
but leave needed_headroom and needed_tailroom set to 0.
When the underlying phy_dev (or stacked lower device) requires extra headroom
or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or
veth with rx headroom), upper layers calculating packet headroom and tailroom
fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN
slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()
prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans
in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Severity
9.8 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
2ad7bf3638411cb547f2823df08166c13ab04269 , < af602c4d0ee548da18e2409b4b4da1079625a372
(git)
Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < f3c17ff65f54781cde696e16a6c577615ed735aa (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < c0fbe31f6b20ade0465130685859faa5c86fda59 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 5f33188457bbcc1b11ca87084037963c516ed3d9 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 5c2ca77212eb38559b0353b8363b7a84f4b019dd (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < e16e960d55a40d36bd7c2494cc005e757dc9a1ef (git) |
guessed | |
| Linux | Linux |
Affected:
3.19
Unaffected: 0 , < 3.19 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af602c4d0ee548da18e2409b4b4da1079625a372",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
},
{
"lessThan": "f3c17ff65f54781cde696e16a6c577615ed735aa",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
},
{
"lessThan": "c0fbe31f6b20ade0465130685859faa5c86fda59",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
},
{
"lessThan": "5f33188457bbcc1b11ca87084037963c516ed3d9",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
},
{
"lessThan": "5c2ca77212eb38559b0353b8363b7a84f4b019dd",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
},
{
"lessThan": "e16e960d55a40d36bd7c2494cc005e757dc9a1ef",
"status": "affected",
"version": "2ad7bf3638411cb547f2823df08166c13ab04269",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ipvlan/ipvlan_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On hosts where admins deployed ipvlan over phy_dev with non-zero headroom (WireGuard/IPsec/macsec/tunnels/veth-XDP), remote packets that trigger egress through the ipvlan netdev (TCP/UDP/ICMP responses, forwarded traffic) reach ipvlan_hard_header/dev_hard_header without local syscalls.\nAC:L - Once the stacked netdev exists, the attacker controls packet sizes and connection patterns to deterministically undersize skb headroom/tailroom; syzbot reproduced KASAN slab-UAF without races or uncontrollable memory layout.\nPR:N - Remote exploitation on pre-deployed ipvlan-over-encrypted/tunneled container or VPN hosts requires no credentials\u2014only network reachability to services using that netdev; CAP_NET_ADMIN is only needed for the alternate local user-namespace setup path.\nUI:N - No victim interaction is required; the attacker either sends crafted network traffic to trigger kernel TX through ipvlan or self-configures the netdev stack via rtnetlink inside a user namespace.\nS:U - Impact is kernel slab skb/net_device memory corruption and local privilege escalation within the same kernel security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Insufficient LL_RESERVED_SPACE causes pskb_expand_head to free still-referenced skb data and dev_hard_header skb_push to access memory outside the buffer; the fix cites KASAN slab-use-after-free, enabling arbitrary kernel memory disclosure.\nI:H - Slab UAF and skb headroom underflow during header prepend give heap-grooming and controlled overwrite primitives on attacker-influenced TX paths, suitable for kernel control-flow hijacking and code execution.\nA:H - Undersized headroom triggers skb_under_panic BUG and KASAN-reported slab-use-after-free oops/panic from softirq/TX paths; remote or local attackers can retrigger repeatedly for reliable kernel denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:05.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372"
},
{
"url": "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa"
},
{
"url": "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59"
},
{
"url": "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9"
},
{
"url": "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd"
},
{
"url": "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef"
}
],
"title": "ipvlan: inherit needed_headroom and needed_tailroom from phy_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74744",
"datePublished": "2026-08-26T14:36:54.773Z",
"dateReserved": "2026-08-15T05:44:03.931Z",
"dateUpdated": "2026-08-27T05:01:05.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74744",
"date": "2026-08-27",
"epss": "0.00519",
"percentile": "0.41919"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74744\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:16:53.250\",\"lastModified\":\"2026-08-27T06:17:24.440\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\\n\\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\\nbut leave needed_headroom and needed_tailroom set to 0.\\n\\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\\nveth with rx headroom), upper layers calculating packet headroom and tailroom\\nfail to reserve sufficient space.\\n\\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\\nprepends header data or when lower devices append tailroom.\\n\\nFix this by:\\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ipvlan/ipvlan_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"af602c4d0ee548da18e2409b4b4da1079625a372\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"f3c17ff65f54781cde696e16a6c577615ed735aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"c0fbe31f6b20ade0465130685859faa5c86fda59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"5f33188457bbcc1b11ca87084037963c516ed3d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"5c2ca77212eb38559b0353b8363b7a84f4b019dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2ad7bf3638411cb547f2823df08166c13ab04269\",\"lessThan\":\"e16e960d55a40d36bd7c2494cc005e757dc9a1ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ipvlan/ipvlan_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-27T06:53:35+00:00",
"cve": "CVE-2026-74744",
"id": "CVE-2026-74744",
"initial_release_date": "2026-08-26T00:00:00+00:00",
"product_status:known_affected": "232",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74744.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…