← Vulnerability feed

Vulnerability record · CVE-2026-74474 · published 15 August 2026

CVE-2026-74474: In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for tr…

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

9.8 CVSS 3.1 Critical EPSS 0.72% · top 47.9% Received
9.8CVSS 3.1 base score
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
6References
14 Sep 2026Last modified by NVD

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

LinkTags
https://git.kernel.org/stable/c/371425d4be7795e9158388af9eee0201e6047410
https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5
https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585
https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9
https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329
https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4

Track CVE-2026-74474 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-74474), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.