CVE-2026-74478um: vector: fix use-after-free in vector_mmsg_rx()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 967c779c9853d2a1cc9cd8e61d300250c348f3d9; from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before a7bc015bb798c525e7a82dd14225c6aeb994274b; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb builds before 7dc9781e320d664c9bdd50003c9acfddf363d1e1; 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb builds before 4b9601595e8b6b5d18878cac0aeabc687d241111; from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 67d58ab4f2ccf7145f3da07e025735a09c79de1b; from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 180ff4c81faf01ec4e06082c9daa7c40518ead89; from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before 804b681002ead233abf49a3efd681f5468a835f9; from 49da7e64f33e80edffb1a9eeb230fa4c3f42dffb before af421e9aed3920c7ac88c24daa48606c7112feca | CNA record |
References
- https://git.kernel.org/stable/c/967c779c9853d2a1cc9cd8e61d300250c348f3d9
- https://git.kernel.org/stable/c/a7bc015bb798c525e7a82dd14225c6aeb994274b
- https://git.kernel.org/stable/c/7dc9781e320d664c9bdd50003c9acfddf363d1e1
- https://git.kernel.org/stable/c/4b9601595e8b6b5d18878cac0aeabc687d241111
- https://git.kernel.org/stable/c/67d58ab4f2ccf7145f3da07e025735a09c79de1b
- https://git.kernel.org/stable/c/180ff4c81faf01ec4e06082c9daa7c40518ead89
- https://git.kernel.org/stable/c/804b681002ead233abf49a3efd681f5468a835f9
- https://git.kernel.org/stable/c/af421e9aed3920c7ac88c24daa48606c7112feca
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.