CVE-2026-74744

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74744", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.931Z", "datePublished": "2026-08-26T14:36:54.773Z", "dateUpdated": "2026-10-16T19:26:23.512Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:05.284Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - On hosts where admins deployed ipvlan over phy_dev with non-zero headroom (WireGuard/IPsec/macsec/tunnels/veth-XDP), remote packets that trigger egress through the ipvlan netdev (TCP/UDP/ICMP responses, forwarded traffic) reach ipvlan_hard_header/dev_hard_header without local syscalls.\nAC:L - Once the stacked netdev exists, the attacker controls packet sizes and connection patterns to deterministically undersize skb headroom/tailroom; syzbot reproduced KASAN slab-UAF without races or uncontrollable memory layout.\nPR:N - Remote exploitation on pre-deployed ipvlan-over-encrypted/tunneled container or VPN hosts requires no credentials\u2014only network reachability to services using that netdev; CAP_NET_ADMIN is only needed for the alternate local user-namespace setup path.\nUI:N - No victim interaction is required; the attacker either sends crafted network traffic to trigger kernel TX through ipvlan or self-configures the netdev stack via rtnetlink inside a user namespace.\nS:U - Impact is kernel slab skb/net_device memory corruption and local privilege escalation within the same kernel security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Insufficient LL_RESERVED_SPACE causes pskb_expand_head to free still-referenced skb data and dev_hard_header skb_push to access memory outside the buffer; the fix cites KASAN slab-use-after-free, enabling arbitrary kernel memory disclosure.\nI:H - Slab UAF and skb headroom underflow during header prepend give heap-grooming and controlled overwrite primitives on attacker-influenced TX paths, suitable for kernel control-flow hijacking and code execution.\nA:H - Undersized headroom triggers skb_under_panic BUG and KASAN-reported slab-use-after-free oops/panic from softirq/TX paths; remote or local attackers can retrigger repeatedly for reliable kernel denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "versions": [{"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "af602c4d0ee548da18e2409b4b4da1079625a372", "status": "affected", "versionType": "git"}, {"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "f3c17ff65f54781cde696e16a6c577615ed735aa", "status": "affected", "versionType": "git"}, {"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "c0fbe31f6b20ade0465130685859faa5c86fda59", "status": "affected", "versionType": "git"}, {"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "5f33188457bbcc1b11ca87084037963c516ed3d9", "status": "affected", "versionType": "git"}, {"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "5c2ca77212eb38559b0353b8363b7a84f4b019dd", "status": "affected", "versionType": "git"}, {"version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "e16e960d55a40d36bd7c2494cc005e757dc9a1ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "versions": [{"version": "3.19", "status": "affected"}, {"version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372"}, {"url": "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa"}, {"url": "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59"}, {"url": "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9"}, {"url": "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd"}, {"url": "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef"}], "title": "ipvlan: inherit needed_headroom and needed_tailroom from phy_dev", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74744", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:16:09.313084Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:23.512Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74744", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:16:09.313084Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:10.346Z"}}], "cna": {"title": "ipvlan: inherit needed_headroom and needed_tailroom from phy_dev", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - On hosts where admins deployed ipvlan over phy_dev with non-zero headroom (WireGuard/IPsec/macsec/tunnels/veth-XDP), remote packets that trigger egress through the ipvlan netdev (TCP/UDP/ICMP responses, forwarded traffic) reach ipvlan_hard_header/dev_hard_header without local syscalls.\nAC:L - Once the stacked netdev exists, the attacker controls packet sizes and connection patterns to deterministically undersize skb headroom/tailroom; syzbot reproduced KASAN slab-UAF without races or uncontrollable memory layout.\nPR:N - Remote exploitation on pre-deployed ipvlan-over-encrypted/tunneled container or VPN hosts requires no credentials\u2014only network reachability to services using that netdev; CAP_NET_ADMIN is only needed for the alternate local user-namespace setup path.\nUI:N - No victim interaction is required; the attacker either sends crafted network traffic to trigger kernel TX through ipvlan or self-configures the netdev stack via rtnetlink inside a user namespace.\nS:U - Impact is kernel slab skb/net_device memory corruption and local privilege escalation within the same kernel security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Insufficient LL_RESERVED_SPACE causes pskb_expand_head to free still-referenced skb data and dev_hard_header skb_push to access memory outside the buffer; the fix cites KASAN slab-use-after-free, enabling arbitrary kernel memory disclosure.\nI:H - Slab UAF and skb headroom underflow during header prepend give heap-grooming and controlled overwrite primitives on attacker-influenced TX paths, suitable for kernel control-flow hijacking and code execution.\nA:H - Undersized headroom triggers skb_under_panic BUG and KASAN-reported slab-use-after-free oops/panic from softirq/TX paths; remote or local attackers can retrigger repeatedly for reliable kernel denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "af602c4d0ee548da18e2409b4b4da1079625a372", "versionType": "git"}, {"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "f3c17ff65f54781cde696e16a6c577615ed735aa", "versionType": "git"}, {"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "c0fbe31f6b20ade0465130685859faa5c86fda59", "versionType": "git"}, {"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "5f33188457bbcc1b11ca87084037963c516ed3d9", "versionType": "git"}, {"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "5c2ca77212eb38559b0353b8363b7a84f4b019dd", "versionType": "git"}, {"status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "lessThan": "e16e960d55a40d36bd7c2494cc005e757dc9a1ef", "versionType": "git"}], "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"status": "unaffected", "version": "0", "lessThan": "3.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372"}, {"url": "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa"}, {"url": "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59"}, {"url": "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9"}, {"url": "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd"}, {"url": "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.153", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.105", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.46", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.10", "versionStartIncluding": "3.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:05.284Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74744", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:23.512Z", "dateReserved": "2026-08-15T05:44:03.931Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-26T14:36:54.773Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af602c4d0ee548da18e2409b4b4da1079625a372", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}, {"lessThan": "f3c17ff65f54781cde696e16a6c577615ed735aa", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}, {"lessThan": "c0fbe31f6b20ade0465130685859faa5c86fda59", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}, {"lessThan": "5f33188457bbcc1b11ca87084037963c516ed3d9", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}, {"lessThan": "5c2ca77212eb38559b0353b8363b7a84f4b019dd", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}, {"lessThan": "e16e960d55a40d36bd7c2494cc005e757dc9a1ef", "status": "affected", "version": "2ad7bf3638411cb547f2823df08166c13ab04269", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ipvlan/ipvlan_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"lessThan": "3.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\n\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\n in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events."}], "id": "CVE-2026-74744", "lastModified": "2026-10-16T20:17:56.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74744", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:16:09.313084Z", "version": "2.0.3"}}]}, "published": "2026-08-26T15:16:53.250", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c2ca77212eb38559b0353b8363b7a84f4b019dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f33188457bbcc1b11ca87084037963c516ed3d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af602c4d0ee548da18e2409b4b4da1079625a372"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0fbe31f6b20ade0465130685859faa5c86fda59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e16e960d55a40d36bd7c2494cc005e757dc9a1ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3c17ff65f54781cde696e16a6c577615ed735aa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev", "id": "2524431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524431"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-124", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipvlan: inherit needed_headroom and needed_tailroom from phy_dev\nipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\nWhen the underlying phy_dev (or stacked lower device) requires extra headroom\nor tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or\nveth with rx headroom), upper layers calculating packet headroom and tailroom\nfail to reserve sufficient space.\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header()\nprepends header data or when lower devices append tailroom.\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans\nin ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.", "A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit `needed_headroom` and `needed_tailroom` from the physical device (`phy_dev`). This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as KASAN slab-use-after-free crashes, and resulting in a denial of service."], "name": "CVE-2026-74744", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74744\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74744\nhttps://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74744-db6f@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,af602c4d0ee548da18e2409b4b4da1079625a372)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,f3c17ff65f54781cde696e16a6c577615ed735aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,c0fbe31f6b20ade0465130685859faa5c86fda59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,5f33188457bbcc1b11ca87084037963c516ed3d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,5c2ca77212eb38559b0353b8363b7a84f4b019dd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ad7bf3638411cb547f2823df08166c13ab04269,e16e960d55a40d36bd7c2494cc005e757dc9a1ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.184,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.153,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.105,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.46,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T15:30:05.170391+00:00", "updated": "2026-08-28T18:00:15.571887+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}