9.1

CVE-2026-74476: linux

CVSS: 9.1v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74476DEBIAN-CVE-2026-74476
Published 15-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74476 is a critical (CVSS 9.1) vulnerability in linux. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 11
OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1SUSE-SU-2026:23897-1SUSE-SU-2026:23902-1SUSE-SU-2026:24181-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.49% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < 0be3632597b8349d43a7dc4244b492dc62a05998 | ≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < 04958dba44dc795dc79ce2fcbc117821bbbd6542 | ≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < 5c1c15c540fc45820ce3033c319151ec891bc10a | ≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb | ≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < f9c1fff857e93be709c8b52ed1a643f37bd82c66 | ≥ 718a18a0c8a67f97781e40bdef7cdd055c430996, < d0d6415963040c401e7a7e4e482a698ba52448cb | 5.18

3 vendors · 145 products

References

12 links
Show all 12 references