CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit neededheadroom and neededtailroom from lowerdev
macvlan devices inherit hardheaderlen from lowerdev during macvlaninit(), but leave neededheadroom and neededtailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when devhardheader() / macvlanhardheader() prepends header data or when lower devices append tailroom.
Fix this by: 1. Inheriting neededheadroom and neededtailroom from lowerdev in macvlaninit(). 2. Propagating neededheadroom and neededtailroom updates to attached macvlans in macvlandeviceevent() when receiving NETDEVFEATCHANGE events.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using macvlan devices over a lower network device that requires additional packet headroom or tailroom are exposed. Examples named in the advisory include lower devices involving MACsec, IPsec, WireGuard, tunnels, or veth interfaces with RX headroom requirements.
What conditions can trigger the failure?
The issue can occur when upper layers do not reserve enough packet headroom or tailroom because the macvlan device reports these requirements as zero. A failure may be triggered when header data is prepended through dev_hard_header() or macvlan_hard_header(), or when the lower device appends trailer data.
How can administrators identify a possible impact?
Potential indicators include unexpected packet-buffer reallocations, skb headroom underflows, or KASAN reports of slab use-after-free crashes. Review whether affected macvlan interfaces are attached to lower devices with extra header or trailer space requirements.
What configuration changes are relevant after applying the fix?
The fix makes macvlan devices inherit needed_headroom and needed_tailroom from their lower device at initialization. It also propagates later changes to those values to attached macvlan devices when the lower device emits a NETDEV_FEAT_CHANGE event.