critical 10.0

CVE-2026-74612 in the critical feed json

veth: fix skb length accounting after XDP frag adjustment

published 2026-08-22 2 mo ago modified 2026-10-16 23 d ago also EUVD-2026-64549

cvss: 10.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb->data_len but leaves skb->len containing the old fragment contribution.

After a fragment shrink, this makes skb_headlen() larger than the actual linear area. In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes past the actual linear tail to userspace, starting at struct skb_shared_info. The copied bytes included the affected skb's nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same amount and truncated at the end.

Subtract the old data_len before replacing it and add the new data_len afterwards, keeping skb->len and skb->data_len synchronized.

Additionally, bpf_xdp_pull_data() can advance data_end while leaving frags present. The skb is then still non-linear, so the old __skb_put(skb, off) triggers SKB_LINEAR_ASSERT().

Use skb_set_tail_pointer() and update skb->len explicitly instead, following bpf_prog_run_generic_xdp(). Unlike __skb_put(), skb_set_tail_pointer() does not require a linear skb.

A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by 1024 bytes from its fragment area. Before the fix, all 10 runs produced corrupted payloads. After the fix, all 10 runs matched the expected payload exactly. A forced-tailroom reproducer also exercises bpf_xdp_pull_data() with frags still present; the old code triggers SKB_LINEAR_ASSERT(), while this fix passes 10/10 runs.

Patch / fix

fixed in 1 distros 5 links 6

Linux Linux 6.1.184, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.187-1
linux Debian 13 6.12.105-1
linux Debian 14 7.1.9-1
linux-6.12 Debian 12 6.12.107-1~deb12u1

debian advisories DEBIAN-CVE-2026-74612

linux Ubuntu 26.04 LTS 7.0.0-42.42
linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
linux-ibm Ubuntu 26.04 LTS 7.0.0-1017.17
linux-riscv Ubuntu 26.04 LTS 7.0.0-42.42.1
linux-oracle Ubuntu 26.04 LTS 7.0.0-1015.16
linux-hwe-7.0 Ubuntu 24.04 LTS 7.0.0-42.42~24.04.1
linux-oem-7.0 Ubuntu 26.04 LTS 7.0.0-1017.17

ubuntu advisories UBUNTU-CVE-2026-74612

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.84.1
kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.84.1
kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1.150700.17.47.1

suse advisories SUSE-SU-2026:4706-1 SUSE-SU-2026:4640-1 SUSE-SU-2026:24316-1 SUSE-SU-2026:24315-1 SUSE-SU-2026:24181-1 SUSE-SU-2026:24182-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1

kernel Azure Linux 3.0 6.6.152.1-1

azure linux advisories AZL-97053

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-74612 updated 2026-11-05 cvss 7.0

kernel: veth: fix skb length accounting after XDP frag adjustment

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
affected: no fix available
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Linux Linux

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-74612
NVD CVE-2026-74612

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary