CVE-2026-74474
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74474
EUVD
EUVD-2026-59667

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of network headers during packet transmission in VXLAN (Virtual Extensible LAN) operations. The issue occurs when pskb_may_pull() is used to verify network layer headers, but it fails to account for the MAC header offset, potentially leaving parts of the header in non-linear fragments.

Detection Guidance

This vulnerability is specific to the Linux kernel's VXLAN implementation and requires kernel code inspection or runtime monitoring. Detection involves checking kernel version and VXLAN-related code paths. Commands like uname -a, modprobe -c | grep vxlan, and examining kernel logs for VXLAN-related errors may help identify affected systems.

Impact Analysis

This vulnerability could lead to packet corruption or processing errors during network transmission in systems using VXLAN. It may cause network instability, data corruption, or denial-of-service conditions if exploited.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the VXLAN header handling issue. If immediate patching is not possible, consider disabling VXLAN functionality temporarily or restricting network access to VXLAN interfaces until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart