UBUNTU-CVE-2026-74701: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract() When a packet arrives on an ARPHRDNONE device (e.g. TUN), ovsflowkeyextract() trusts the user-provided skb->protocol field: if it is ETHPTEB, the packet is classified as MACPROTOETHERNET and keyextract() is called without ensuring the skb has ETHHLEN (14) bytes of linear data. keyextract() unconditionally pulls 2 ETHALEN bytes for MAC addresses and parseethertype() pulls 2 more, either of which triggers a kernel BUG in skbpull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:keyextract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovsflowkeyextract+0x419/0xa70 ovsvportreceive+0x222/0x390 netdevframehook+0x3e0/0x630 tungetuser+0x2d0c/0x38e0 Fixed by calling checkheader() in keyextract() before accessing the Ethernet header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1117.124~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1123.132~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1122.131~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1118.128~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-198.208~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1112.118~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-195.205~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-198.208 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1122.131 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1113.119 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1100.108 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1112.118 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1109.114 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-195.205 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1112.113 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1080.84 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1101.103 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1109.111 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1116.125 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-198.208+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128+fips1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Compensating control
In Linux kernel net/openvswitch key_extract(), call check_header() before accessing the Ethernet header to ensure the skb has ETH_HLEN (14) bytes of linear data.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using Open vSwitch with packets received from an ARPHRD_NONE device, such as a TUN interface, are exposed when those packets can be presented with skb->protocol set to ETH_P_TEB. The affected Ubuntu kernel package families listed are linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle.
What does an attacker need to trigger the failure?
An attacker needs local privileges and the ability to supply a malformed short packet through an ARPHRD_NONE device into the Open vSwitch receive path. The packet must be treated as Ethernet through the user-provided protocol value while having fewer than 14 bytes of linear Ethernet-header data.
What is the likely impact of successful exploitation?
The vulnerable path can trigger a kernel BUG in __skb_pull() while Open vSwitch extracts the flow key. The provided severity vector rates confidentiality, integrity, and availability impacts as high.
How can I identify evidence that the issue was triggered?
Look for a kernel BUG referencing include/linux/skbuff.h:2848, with key_extract in net/openvswitch/flow.c in the stack trace. The described call chain includes ovs_flow_key_extract, ovs_vport_receive, netdev_frame_hook, and tun_get_user.
What change fixes the vulnerable code path?
The fix calls check_header() in key_extract() before accessing the Ethernet header. This prevents processing Ethernet-classified packets that do not contain sufficient header data.