CVE-2026-74684
Received Received - Intake

NULL Pointer Dereference in Linux Kernel TAP Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74684
EUVD
EUVD-2026-64371

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's TAP network device driver. It occurs when parsing a virtio net header before assigning the socket buffer's device pointer. This can lead to a system crash if an XDP buffer with a GSO virtio-net header and zero protocol is processed.

Detection Guidance

This vulnerability is specific to the Linux kernel's TAP driver and may not have direct detection commands. Monitor kernel logs for crashes related to TAP devices or virtio-net headers. Check for NULL pointer dereference errors in system logs after XDP or virtio-net operations.

Impact Analysis

This vulnerability can cause a kernel crash (denial of service) when processing specific network packets. Systems using TAP devices with XDP or virtio-net features may become unstable or reboot unexpectedly upon receiving maliciously crafted packets.

Mitigation Strategies

Apply the kernel patch that fixes the issue by ensuring skb->dev is set before parsing the virtio-net header in tap_get_user_xdp(). Update to a patched kernel version. If immediate patching is not possible, avoid using XDP with TAP devices or disable GSO virtio-net headers in affected configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart