CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

Published Aug 26, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: inherit neededheadroom and neededtailroom from phydev

ipvlan devices inherit hardheaderlen from phydev during ipvlaninit(), but leave neededheadroom and neededtailroom set to 0.

When the underlying phydev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.

This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when devhardheader() / ipvlanhardheader() prepends header data or when lower devices append tailroom.

Fix this by: 1. Inheriting neededheadroom and neededtailroom from phydev in ipvlaninit(). 2. Propagating neededheadroom and neededtailroom updates to attached ipvlans in ipvlandeviceevent() when receiving NETDEVFEATCHANGE events.

Affected Software

1 affected component

Linux Kernel

Event History

Aug 26, 2026

CVE Published

via MITRE·02:36 PM

Data Sourced

via MITRE·02:36 PM

Description

Data Sourced

via NVD·03:16 PM

Description

Frequently Asked Questions

Which network configurations are most likely to be affected?

Ipvlan devices attached to a physical or stacked lower device that requires additional packet headroom or tailroom are affected. Examples named in the advisory include MACsec, IPsec, WireGuard, tunnels, and veth devices with RX headroom requirements.

When can the issue be triggered?

It can occur when ipvlan or device header handling prepends data without sufficient reserved headroom, or when a lower device appends data without sufficient tailroom. Required buffer-space changes on the lower device can also matter when they are reported through NETDEV_FEAT_CHANGE events.

What indicates that the vulnerability is present in an ipvlan deployment?

A relevant configuration has ipvlan attached to a lower device with nonzero needed_headroom or needed_tailroom requirements, while the ipvlan device does not inherit or receive updates for those values. Observable effects can include packet-buffer reallocations, skb headroom underflows, or KASAN slab-use-after-free crashes.

CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

Affected Software

Event History

Frequently Asked Questions

Which network configurations are most likely to be affected?

When can the issue be triggered?

What indicates that the vulnerability is present in an ipvlan deployment?

Company

Resources

Contact

Frequently Asked Questions

Which network configurations are most likely to be affected?

When can the issue be triggered?

What indicates that the vulnerability is present in an ipvlan deployment?