CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: inherit neededheadroom and neededtailroom from phydev
ipvlan devices inherit hardheaderlen from phydev during ipvlaninit(), but leave neededheadroom and neededtailroom set to 0.
When the underlying phydev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when devhardheader() / ipvlanhardheader() prepends header data or when lower devices append tailroom.
Fix this by: 1. Inheriting neededheadroom and neededtailroom from phydev in ipvlaninit(). 2. Propagating neededheadroom and neededtailroom updates to attached ipvlans in ipvlandeviceevent() when receiving NETDEVFEATCHANGE events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which network configurations are most likely to be affected?
Ipvlan devices attached to a physical or stacked lower device that requires additional packet headroom or tailroom are affected. Examples named in the advisory include MACsec, IPsec, WireGuard, tunnels, and veth devices with RX headroom requirements.
When can the issue be triggered?
It can occur when ipvlan or device header handling prepends data without sufficient reserved headroom, or when a lower device appends data without sufficient tailroom. Required buffer-space changes on the lower device can also matter when they are reported through NETDEV_FEAT_CHANGE events.
What indicates that the vulnerability is present in an ipvlan deployment?
A relevant configuration has ipvlan attached to a lower device with nonzero needed_headroom or needed_tailroom requirements, while the ipvlan device does not inherit or receive updates for those values. Observable effects can include packet-buffer reallocations, skb headroom underflows, or KASAN slab-use-after-free crashes.