UBUNTU-CVE-2026-74744: Use After Free
In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit(), but leave neededheadroom and neededtailroom set to 0. When the underlying phydev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when devhardheader() / ipvlanhardheader() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting neededheadroom and neededtailroom from phydev in ipvlaninit(). 2. Propagating neededheadroom and neededtailroom updates to attached ipvlans in ipvlandeviceevent() when receiving NETDEVFEATCHANGE events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to be exposed to this issue?
Systems using ipvlan devices over a physical or stacked lower network device that requires additional packet headroom or tailroom are exposed. Examples named in the advisory include macsec, ipsec, WireGuard, tunnels, and veth configurations with receive headroom.
What access does an attacker need to exploit this vulnerability?
The supplied vector indicates local access, high attack complexity, and low privileges required, with no user interaction. The data does not describe a specific exploitation path beyond triggering insufficient packet buffer space through affected ipvlan networking.
Are default ipvlan configurations affected?
The issue depends on the underlying physical or stacked lower device requiring extra headroom or tailroom. The provided information does not establish that a basic ipvlan configuration without such a lower-device requirement is affected.
What can happen on an affected host?
Insufficient packet buffer reservation can cause reallocation overhead, skb headroom underflows, or KASAN-detected slab use-after-free crashes. The severity vector indicates potential high impact to confidentiality, integrity, and availability within the vulnerable component.
How can administrators identify potentially affected configurations?
Review hosts using ipvlan and determine whether the ipvlan lower device is a network stack requiring extra header or trailer space, such as macsec, ipsec, WireGuard, tunnels, or relevant veth setups. Also consider configurations where lower-device feature changes may alter headroom or tailroom requirements after ipvlan devices are attached.