9.8

CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls

Received
AliasesUBUNTU-CVE-2026-74474DEBIAN-CVE-2026-74474
Published 15-08-2026Last modified 16-10-2026

Vulnerability summary

CVE-2026-74474 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 42.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 05-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.49%
0%100%
Low · -0.23 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 15
OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:23881-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

Decrease -0.23 pp

From 0.72% on 06-10-2026

06-10-202605-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 7.0.0-42.42
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 7.0.0-1016.17
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ e4f67addf158f98f8197e08974966b18480dc751, < 371425d4be7795e9158388af9eee0201e6047410 | ≥ e4f67addf158f98f8197e08974966b18480dc751, < bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4 | ≥ e4f67addf158f98f8197e08974966b18480dc751, < 6146901881f09ef063eb34ad389f63231f8486f5 | ≥ e4f67addf158f98f8197e08974966b18480dc751, < 94dee751aad627b3645d424b5d0c736d394573e9 | ≥ e4f67addf158f98f8197e08974966b18480dc751, < 7076a34b6e33315dc160b4612bfea1c597495585 | ≥ e4f67addf158f98f8197e08974966b18480dc751, < b9553558b48db54ac9273e6b98d7263ef5c1a329 | 3.8

3 vendors · 172 products

References

14 links
Show all 14 references