CVE-2026-74701
Received Received - Intake

Buffer Overflow in Open vSwitch Kernel Module

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0 Fixed by calling check_header() in key_extract() before accessing the Ethernet header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74701
EUVD
EUVD-2026-64388

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)
openvswitch openvswitch to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when processing packets on ARPHRD_NONE devices like TUN. The issue arises when the kernel trusts a user-provided protocol field, leading to incorrect packet classification. This causes the key_extract function to access insufficient data, triggering a kernel bug when pulling more bytes than available in the packet's linear data area.

Detection Guidance

This vulnerability triggers a kernel BUG when processing packets on ARPHRD_NONE devices with malformed Ethernet headers. Detection requires checking kernel logs for BUG messages or crashes related to openvswitch or skbuff operations.

Impact Analysis

This vulnerability can cause a kernel crash (BUG) due to memory access violations when processing certain network packets. This may lead to denial-of-service conditions, system instability, or potential privilege escalation if exploited maliciously. Systems using Open vSwitch or TUN devices are particularly affected.

Mitigation Strategies

Apply the Linux kernel patch that adds check_header() in key_extract() to validate Ethernet header length before processing. Update Open vSwitch to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart