CVE-2026-74476 (GCVE-0-2026-74476)
Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
EPSS
VEX
Title
veth: convert frag_list skbs before running XDP
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: convert frag_list skbs before running XDP
A frag_list skb can reach veth with data_len set but nr_frags zero.
veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
locked, have frags[], or do not have enough headroom. It later uses
skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
xdp_frags_size.
That exposes frag_list data to XDP as if it were stored in frags[], but
frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
metadata, walk an empty fragment entry, and crash in memcpy() from
__xsk_rcv().
Route non-linear skbs through skb_pp_cow_data() before exposing them to
XDP, and only advertise XDP frags when the resulting skb has frags[].
skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
builds frags[] output with skb_add_rx_frag(), which is the
representation XDP multi-buffer expects.
Severity
9.1 (Critical)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
718a18a0c8a67f97781e40bdef7cdd055c430996 , < 0be3632597b8349d43a7dc4244b492dc62a05998
(git)
Affected: 718a18a0c8a67f97781e40bdef7cdd055c430996 , < 04958dba44dc795dc79ce2fcbc117821bbbd6542 (git) Affected: 718a18a0c8a67f97781e40bdef7cdd055c430996 , < 5c1c15c540fc45820ce3033c319151ec891bc10a (git) Affected: 718a18a0c8a67f97781e40bdef7cdd055c430996 , < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb (git) Affected: 718a18a0c8a67f97781e40bdef7cdd055c430996 , < f9c1fff857e93be709c8b52ed1a643f37bd82c66 (git) Affected: 718a18a0c8a67f97781e40bdef7cdd055c430996 , < d0d6415963040c401e7a7e4e482a698ba52448cb (git) |
guessed | |
| Linux | Linux |
Affected:
5.18
Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.184 , ≤ 6.1.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c",
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0be3632597b8349d43a7dc4244b492dc62a05998",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "04958dba44dc795dc79ce2fcbc117821bbbd6542",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "5c1c15c540fc45820ce3033c319151ec891bc10a",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "f9c1fff857e93be709c8b52ed1a643f37bd82c66",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "d0d6415963040c401e7a7e4e482a698ba52448cb",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c",
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit when a received skb traverses veth XDP processing; in cloud/container deployments (e.g. Cloudflare-style edge nodes) remote traffic routed to a veth peer with XDP+AF_XDP can deliver the malformed frag_list skb without local access.\nAC:L - An attacker can reliably supply the required frag_list skb (data_len\u003e0, nr_frags=0) by transmitting from the veth peer via sockets or GRO aggregation, controlling packet size, timing, and content without depending on uncontrollable kernel state.\nPR:N - Remote exploitation needs no attacker privileges when ingress traffic reaches a veth that already has an XDP program redirecting to an AF_XDP socket; only network-delivered skbs trigger veth_convert_skb_to_xdp_buff() and the faulty __xsk_rcv() path.\nUI:N - No victim user action is required beyond normal network traffic reaching the veth interface; exploitation is automatic once a qualifying frag_list skb is received and redirected to AF_XDP copy mode.\nS:U - The flaw causes kernel memory reads and crashes within the host kernel security boundary; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - Bogus XDP_FLAGS_HAS_FRAGS metadata makes __xsk_rcv() memcpy from uninitialized frags[] entries via skb_frag_address(), enabling out-of-bounds kernel memory reads into the AF_XDP receive buffer before faulting.\nI:N - The failure mode is a kernel-side memcpy read using invalid fragment metadata; data is copied into the attacker\u0027s AF_XDP ring buffer rather than corrupting kernel or other tenants\u0027 memory for integrity purposes.\nA:H - The commit and code path confirm a kernel crash when __xsk_rcv() follows bogus fragment metadata and memcpy faults on an invalid frags[] source address, causing oops/panic and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:22.315Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998"
},
{
"url": "https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542"
},
{
"url": "https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a"
},
{
"url": "https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb"
},
{
"url": "https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66"
},
{
"url": "https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb"
}
],
"title": "veth: convert frag_list skbs before running XDP",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74476",
"datePublished": "2026-08-15T12:27:11.309Z",
"dateReserved": "2026-08-15T05:44:03.903Z",
"dateUpdated": "2026-08-23T12:47:22.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74476",
"date": "2026-09-21",
"epss": "0.00491",
"percentile": "0.4115"
},
"microsoft_vex": {
"current_release_date": "2026-08-23T15:00:49.000Z",
"cve": "CVE-2026-74476",
"id": "msrc_CVE-2026-74476",
"initial_release_date": "2026-08-23T15:00:49.000Z",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "veth: convert frag_list skbs before running XDP",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74476.json",
"version": "1"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c",
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0be3632597b8349d43a7dc4244b492dc62a05998",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "04958dba44dc795dc79ce2fcbc117821bbbd6542",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "5c1c15c540fc45820ce3033c319151ec891bc10a",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "f9c1fff857e93be709c8b52ed1a643f37bd82c66",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
},
{
"lessThan": "d0d6415963040c401e7a7e4e482a698ba52448cb",
"status": "affected",
"version": "718a18a0c8a67f97781e40bdef7cdd055c430996",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c",
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects."
}
],
"id": "CVE-2026-74476",
"lastModified": "2026-08-23T13:16:44.250",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-15T13:17:52.397",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-21T07:20:01+00:00",
"cve": "CVE-2026-74476",
"id": "CVE-2026-74476",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "76",
"product_status:under_investigation": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: veth: convert frag_list skbs before running XDP",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74476.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-15T01:20:28Z",
"cve": "CVE-2026-74476",
"id": "CVE-2026-74476",
"initial_release_date": "2026-08-15T23:52:11Z",
"product_status:known_affected": "123",
"product_status:known_not_affected": "239",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-74476",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74476.json",
"version": "7"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…