CVE-2026-74474 PUBLISHED

vxlan: use pskb_network_may_pull() for transmit path header pulls

Assigner: Linux
Reserved: 15.08.2026 Published: 15.08.2026 Updated: 15.08.2026

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() for transmit path header pulls

In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys).

However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags.

Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from e4f67addf158f98f8197e08974966b18480dc751 to 94dee751aad627b3645d424b5d0c736d394573e9 (excl.)
  • affected from e4f67addf158f98f8197e08974966b18480dc751 to 7076a34b6e33315dc160b4612bfea1c597495585 (excl.)
  • affected from e4f67addf158f98f8197e08974966b18480dc751 to b9553558b48db54ac9273e6b98d7263ef5c1a329 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 3.8 is affected
  • unaffected from 0 to 3.8 (excl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.8 to 7.1.* (incl.)
  • unaffected from 7.2-rc6 to * (incl.)

References