CVE-2026-74474vxlan: use pskb_network_may_pull() for transmit path header pulls
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e4f67addf158f98f8197e08974966b18480dc751 before 371425d4be7795e9158388af9eee0201e6047410; from e4f67addf158f98f8197e08974966b18480dc751 before bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4; from e4f67addf158f98f8197e08974966b18480dc751 before 6146901881f09ef063eb34ad389f63231f8486f5; from e4f67addf158f98f8197e08974966b18480dc751 before 94dee751aad627b3645d424b5d0c736d394573e9; from e4f67addf158f98f8197e08974966b18480dc751 before 7076a34b6e33315dc160b4612bfea1c597495585; from e4f67addf158f98f8197e08974966b18480dc751 before b9553558b48db54ac9273e6b98d7263ef5c1a329 | CNA record |
References
- https://git.kernel.org/stable/c/371425d4be7795e9158388af9eee0201e6047410
- https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4
- https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5
- https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9
- https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585
- https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.