CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation
skbudptunnelsegment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
Affected Software
Event History
Frequently Asked Questions
What traffic path is affected?
The issue is in UDP tunnel segmentation, specifically in __skb_udp_tunnel_segment(). Systems that do not use this kernel path are not indicated as affected by the provided information.
What triggers the invalid pointer condition?
The condition can occur when the tunnel header must be pulled into the skb head and that pull reallocates skb->head. A UDP header pointer obtained before that reallocation can then become invalid.
What does the fix change?
The fix retrieves the UDP header only after ensuring the tunnel header is in the skb head. This prevents use of a stale UDP header pointer after a possible skb head reallocation.