CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. Get the UDP header after the pull to avoid a potential use-after-free.
- CVSS
- 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 6a733a38b983d8c2e222f13968209010cf44de87; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 19d89b13a43640b2da2f277ee462d919d988cb6f; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before b3df61bb745eb5201eac22679a2839d4ccbf3442; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 1ae134c012e10384cdac420b5cc6e0615cde0b55; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 5161e67c561c4f28a5d9335a6e859b02511de92b; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 64d322c288577793eedd352b96ef75234ed380fe; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before 588d4a6795d99d080f74ef0b5f391ea8c453ae5d; from dbef491ebe7f3a4fb1b9111878b86a426fd540b7 before d0f86fb36eb260abd10007b62c9dcc1028e03e61 | CNA record |
References
- https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87
- https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f
- https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442
- https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55
- https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b
- https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe
- https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d
- https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.