CVE-2026-74473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.903Z", "datePublished": "2026-08-15T12:27:09.382Z", "dateUpdated": "2026-10-16T19:05:47.966Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:37:25.639Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\n\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - route_shortcircuit() runs in vxlan_xmit() during overlay transmit; remote packets forwarded or routed onto a VXLAN netdev with route-short-circuit enabled reach this path without local access, matching net-stack guidance for network-reachable packet processing on cloud/SDN nodes.\nAC:L - An attacker can reliably craft non-linear skbs (scatter/gather/frags and size boundaries) and aim traffic at a known router MAC in the VXLAN FDB; no race or uncontrollable memory layout is required beyond targeting an RSC-enabled deployment, which is the scored scenario.\nPR:N - Exploitation needs no credentials or capabilities on the victim when VXLAN RSC is already configured; a remote peer only has to send IPv4/IPv6 frames that traverse the tunnel transmit path, with no netlink setup or CAP_NET_ADMIN in the target namespace.\nUI:N - Triggering the bug requires only attacker-controlled network traffic through the overlay; no victim mount, file open, link click, or other interactive action is needed.\nS:U - Impact is confined to the kernel hosting the VXLAN endpoint (memory disclosure, packet-header corruption, or crash); it does not cross VM, container, or IOMMU security boundaries by itself.\nC:H - The faulty pskb_may_pull() check leaves the IP/IPv6 header in non-linear frags, so ip_hdr(skb)->daddr/ipv6 daddr is read past the linear head and can disclose adjacent kernel memory per OOB-read guidance.\nI:H - The out-of-bounds destination address feeds neigh_lookup() and may rewrite eth_hdr()->h_dest before encapsulation, giving attacker-influenced overlay forwarding and a memory-safety primitive in the transmit path.\nA:H - Dereferencing network-header fields beyond the pulled linear buffer can provoke kernel oops/panic on affected skb layouts, and OOB reads in xmit context are treated as high availability impact even when exploitation is not fully weaponized."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "versions": [{"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "c419af4924c1593500a40519730ed98575d04a3e", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd", "status": "affected", "versionType": "git"}, {"version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "versions": [{"version": "3.8", "status": "affected"}, {"version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e"}, {"url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4"}, {"url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53"}, {"url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c"}, {"url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4"}, {"url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7"}, {"url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd"}, {"url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb"}], "title": "vxlan: use pskb_network_may_pull() in route_shortcircuit()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:57:24.199754Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:47.966Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74473", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:57:24.199754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:57:24.785Z"}}], "cna": {"title": "vxlan: use pskb_network_may_pull() in route_shortcircuit()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - route_shortcircuit() runs in vxlan_xmit() during overlay transmit; remote packets forwarded or routed onto a VXLAN netdev with route-short-circuit enabled reach this path without local access, matching net-stack guidance for network-reachable packet processing on cloud/SDN nodes.\nAC:L - An attacker can reliably craft non-linear skbs (scatter/gather/frags and size boundaries) and aim traffic at a known router MAC in the VXLAN FDB; no race or uncontrollable memory layout is required beyond targeting an RSC-enabled deployment, which is the scored scenario.\nPR:N - Exploitation needs no credentials or capabilities on the victim when VXLAN RSC is already configured; a remote peer only has to send IPv4/IPv6 frames that traverse the tunnel transmit path, with no netlink setup or CAP_NET_ADMIN in the target namespace.\nUI:N - Triggering the bug requires only attacker-controlled network traffic through the overlay; no victim mount, file open, link click, or other interactive action is needed.\nS:U - Impact is confined to the kernel hosting the VXLAN endpoint (memory disclosure, packet-header corruption, or crash); it does not cross VM, container, or IOMMU security boundaries by itself.\nC:H - The faulty pskb_may_pull() check leaves the IP/IPv6 header in non-linear frags, so ip_hdr(skb)->daddr/ipv6 daddr is read past the linear head and can disclose adjacent kernel memory per OOB-read guidance.\nI:H - The out-of-bounds destination address feeds neigh_lookup() and may rewrite eth_hdr()->h_dest before encapsulation, giving attacker-influenced overlay forwarding and a memory-safety primitive in the transmit path.\nA:H - Dereferencing network-header fields beyond the pulled linear buffer can provoke kernel oops/panic on affected skb layouts, and OOB reads in xmit context are treated as high availability impact even when exploitation is not fully weaponized."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "c419af4924c1593500a40519730ed98575d04a3e", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd", "versionType": "git"}, {"status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb", "versionType": "git"}], "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"status": "unaffected", "version": "0", "lessThan": "3.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e"}, {"url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4"}, {"url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53"}, {"url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c"}, {"url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4"}, {"url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7"}, {"url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd"}, {"url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\n\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:37:25.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74473", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:47.966Z", "dateReserved": "2026-08-15T05:44:03.903Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T12:27:09.382Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c419af4924c1593500a40519730ed98575d04a3e", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}, {"lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb", "status": "affected", "version": "e4f67addf158f98f8197e08974966b18480dc751", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"lessThan": "3.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\n\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."}], "id": "CVE-2026-74473", "lastModified": "2026-10-16T20:17:30.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74473", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:57:24.199754Z", "version": "2.0.3"}}]}, "published": "2026-08-15T13:17:52.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vxlan: use pskb_network_may_pull() in route_shortcircuit()", "id": "2517051", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517051"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer.", "A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation. An incorrect buffer length check in the `route_shortcircuit()` function, specifically when using `pskb_may_pull()`, can lead to reading beyond the allocated buffer length. This occurs when processing IP headers in non-linear network packet fragments. This vulnerability could potentially allow an attacker to access sensitive information or cause a denial of service."], "name": "CVE-2026-74473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74473\nhttps://lore.kernel.org/linux-cve-announce/2026081535-CVE-2026-74473-9c71@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4f67addf158f98f8197e08974966b18480dc751,42887be7c4cf283cce02cd0fb6411221167c8b6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4f67addf158f98f8197e08974966b18480dc751,aa0d31376d574ac858a40078431a77127bf04ee4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4f67addf158f98f8197e08974966b18480dc751,ee799977d7941dbfb11049e17edd9eaf4f8820f7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4f67addf158f98f8197e08974966b18480dc751,4f3f96e771a20263635bb5e1307c112d613b4bbd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e4f67addf158f98f8197e08974966b18480dc751,26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:45:06.745364+00:00", "updated": "2026-08-21T22:00:15.021508+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}