{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74474", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.903Z", "datePublished": "2026-08-15T12:27:10.037Z", "dateUpdated": "2026-08-17T05:47:35.265Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:47:35.265Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb->data points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in VXLAN transmit handling reached when overlay/bridged traffic is sent through a VXLAN netdev; remote peers on cloud/Kubernetes/OpenStack overlay networks can inject ARP, ND, or multicast frames that traverse vxlan_xmit without local shell access.\nAC:L - Once a VXLAN device has proxy or MDB enabled, an attacker can reliably craft non-linear sk_buff frames (fragmented payloads with headers split across head/frags) to pass the undersized pskb_may_pull check and trigger out-of-bounds header reads.\nPR:N - Exploitation requires only the ability to send L2/L3 traffic on an existing VXLAN overlay; no host credentials, root, or CAP_NET_ADMIN on the victim are needed because any unauthenticated remote tenant VM, pod, or overlay peer can forward triggering frames into the transmit path.\nUI:N - No victim user action is required; the kernel processes attacker-supplied network frames automatically during normal overlay bridging and VXLAN encapsulation.\nS:U - Impact is confined to the kernel network stack on the affected host; it does not cross a VM, container, or hypervisor security boundary into a different authority.\nC:H - Undersized pskb_may_pull allows direct network-header pointer access past skb_headlen into non-linear frags or adjacent kernel memory, constituting an out-of-bounds kernel read capable of disclosing sensitive heap or packet-buffer contents.\nI:H - Out-of-bounds parsed ARP, ND, and IP header fields drive proxy neighbour replies and MDB multicast forwarding decisions, letting an attacker influence overlay neighbour resolution and traffic redirection on the victim node.\nA:H - Out-of-bounds header access in the atomic VXLAN transmit path can cause kernel oops or panic, and an unauthenticated remote attacker can trigger this repeatedly for denial of service against VXLAN-enabled infrastructure nodes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c", "drivers/net/vxlan/vxlan_mdb.c"], "versions": [{"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "94dee751aad627b3645d424b5d0c736d394573e9", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "7076a34b6e33315dc160b4612bfea1c597495585", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "b9553558b48db54ac9273e6b98d7263ef5c1a329", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c", "drivers/net/vxlan/vxlan_mdb.c"], "versions": [{"version": "3.8", "status": "affected"}, {"version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9"}, {"url": "https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585"}, {"url": "https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329"}], "title": "vxlan: use pskb_network_may_pull() for transmit path header pulls", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c", "drivers/net/vxlan/vxlan_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "94dee751aad627b3645d424b5d0c736d394573e9", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "7076a34b6e33315dc160b4612bfea1c597495585", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "b9553558b48db54ac9273e6b98d7263ef5c1a329", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c", "drivers/net/vxlan/vxlan_mdb.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"lessThan": "3.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() for transmit path header pulls\n\nIn vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was\nbeing called to verify the availability of network layer headers (ARP, IPv6/ND,\nIP/IPv6 MDB keys).\n\nHowever, during transmit skb->data points to the MAC header, so skb_network_offset(skb)\nis ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data\nrather than skb_network_offset(skb) + len, which can leave part of the network header\nin non-linear frags.\n\nReplace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly\naccount for the MAC header offset."}], "id": "CVE-2026-74474", "lastModified": "2026-08-17T06:19:43.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:52.177", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}