CVE-2026-74476

Received Received - Intake

Buffer Overflow in Linux Kernel XDP Processing

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74476

EUVD

EUVD-2026-59669

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of network packets with frag_list. A frag_list skb can reach the veth interface with data_len set but no actual fragments. The veth_convert_skb_to_xdp_buff function fails to convert such skbs properly before exposing them to XDP (eXpress Data Path). This leads to incorrect metadata being set, causing AF_XDP copy mode to crash due to accessing empty fragment entries.

Detection Guidance

This vulnerability is specific to the Linux kernel's veth driver and XDP processing. Detection requires checking kernel logs for crashes related to AF_XDP or XDP processing, particularly when frag_list skbs are involved. Monitor for kernel oops or panics in XDP-related contexts.

Impact Analysis

If exploited, this vulnerability could cause a system crash or denial of service by triggering a kernel panic in the AF_XDP subsystem. Systems using XDP for high-performance networking may experience instability or unexpected failures when processing certain network packets.

Compliance Impact

This vulnerability is a Linux kernel issue related to network packet handling in veth interfaces. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in packet processing rather than a data protection or privacy issue.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version that includes the fix for veth_convert_skb_to_xdp_buff() and skb_pp_cow_data() integration. Avoid using AF_XDP copy mode until patched.

Hi! I’m here to help you understand CVE-2026-74476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70