CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskbnetworkmaypull() for transmit path header pulls
In vxlanxmit(), arpreduce(), and vxlanmdbentryskbget(), pskbmaypull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys).
However, during transmit skb->data points to the MAC header, so skbnetworkoffset(skb) is ETHHLEN (14 bytes). Using pskbmaypull(skb, len) only checks len bytes from skb->data rather than skbnetworkoffset(skb) + len, which can leave part of the network header in non-linear frags.
Replace these remaining pskbmaypull() calls with pskbnetworkmaypull() to properly account for the MAC header offset.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel vxlan_xmit/arp_reduce/vxlan_mdb_entry_skb_get fixto a version that resolves this vulnerability.Patch vxlan: use pskb_network_may_pull() for transmit path header pulls
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74474?
The severity of CVE-2026-74474 is rated at 34, indicating a moderate risk level.
How do I fix CVE-2026-74474?
To fix CVE-2026-74474, update your Linux kernel to the latest version that resolves this vulnerability.
What type of systems are affected by CVE-2026-74474?
CVE-2026-74474 affects systems running the Linux kernel, specifically those utilizing VXLAN features.
What does CVE-2026-74474 address in the Linux kernel?
CVE-2026-74474 addresses the improper handling of network layer header availability in the VXLAN transmit path.
Is CVE-2026-74474 completely resolved in newer kernel versions?
Yes, CVE-2026-74474 has been resolved in newer Linux kernel versions through specific code updates.