CVE-2026-74478

Received Received - Intake

Use-After-Free in Linux Kernel Vector RX Path

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74478

EUVD

EUVD-2026-59671

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's vector_mmsg_rx() function. It occurs when a packet's overlay header fails verification, causing the function to free the skb buffer but skip advancing internal pointers. This leaves a dangling reference to freed memory, which can be accessed again in the next loop iteration, leading to a use-after-free condition in the RX path.

Detection Guidance

This vulnerability is specific to the Linux kernel's vector_mmsg_rx() function in the um: vector subsystem. Detection requires checking for kernel logs or crashes related to use-after-free errors in RX paths, particularly with GRE or L2TPv3 transports. Monitor for kernel oops messages or system crashes during packet processing.

Impact Analysis

An attacker on the same network segment could exploit this to cause a kernel crash or execute arbitrary code with kernel privileges. This could lead to denial of service, privilege escalation, or data corruption. Systems using GRE or L2TPv3 transports are specifically vulnerable as they allow unauthenticated triggering of this issue.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's RX path for GRE and L2TPv3 transports. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel-level packet handling flaws.

Mitigation Strategies

Apply the latest Linux kernel patches to address the use-after-free in vector_mmsg_rx(). If immediate patching is not possible, disable GRE or L2TPv3 transports if unused. Monitor network traffic for malformed packets triggering the vulnerability.

Hi! I’m here to help you understand CVE-2026-74478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70