CVE-2026-74473vxlan: use pskb_network_may_pull() in route_shortcircuit()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e4f67addf158f98f8197e08974966b18480dc751 before c419af4924c1593500a40519730ed98575d04a3e; from e4f67addf158f98f8197e08974966b18480dc751 before 6bd0a3a1b5744166946f0c551a6665c3b46b05e4; from e4f67addf158f98f8197e08974966b18480dc751 before 214ba43faf106cb06cd3dd30999c5c809c868b53; from e4f67addf158f98f8197e08974966b18480dc751 before 42887be7c4cf283cce02cd0fb6411221167c8b6c; from e4f67addf158f98f8197e08974966b18480dc751 before aa0d31376d574ac858a40078431a77127bf04ee4; from e4f67addf158f98f8197e08974966b18480dc751 before ee799977d7941dbfb11049e17edd9eaf4f8820f7; from e4f67addf158f98f8197e08974966b18480dc751 before 4f3f96e771a20263635bb5e1307c112d613b4bbd; from e4f67addf158f98f8197e08974966b18480dc751 before 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb | CNA record |
References
- https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e
- https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4
- https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53
- https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c
- https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4
- https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7
- https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd
- https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.