CVE-2026-74743
Received Received - Intake

macvlan Heap Overflow Due to Missing Headroom Inheritance

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74743
EUVD
EUVD-2026-66573

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where macvlan devices fail to inherit needed headroom and tailroom from their underlying network device. This can cause packet header/trailer miscalculations, leading to reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when headers are prepended or trailers appended.

Detection Guidance

This vulnerability may cause packet headroom/tailroom miscalculations or crashes in macvlan devices. Check for kernel logs for KASAN slab-use-after-free errors or skb headroom underflows. Monitor macvlan device initialization for missing needed_headroom/needed_tailroom inheritance.

Impact Analysis

If you use macvlan devices with underlying interfaces requiring extra headroom or tailroom (e.g., macsec, ipsec, wireguard, tunnels, or veth with rx headroom), this flaw may cause network packet corruption, crashes, or performance degradation due to incorrect buffer handling.

Mitigation Strategies

Apply the Linux kernel patch that inherits needed_headroom and needed_tailroom from lowerdev in macvlan_init. Update to a kernel version containing the fix. Monitor for related crashes or misconfigurations after patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart