{"id":"CVE-2026-74476","title":"veth: convert frag_list skbs before running XDP","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs t…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 0be3632597b8349d43a7dc4244b492dc62a05998","Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 04958dba44dc795dc79ce2fcbc117821bbbd6542","Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 5c1c15c540fc45820ce3033c319151ec891bc10a","Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < f9c1fff857e93be709c8b52ed1a643f37bd82c66","Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < d0d6415963040c401e7a7e4e482a698ba52448cb","Linux 5.18"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T18:57:33.426846Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:48.477Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74476","references":[{"url":"https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998"},{"url":"https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542"},{"url":"https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a"},{"url":"https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb"},{"url":"https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66"},{"url":"https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb"}],"tags":["cve.org"],"epss":0.00491,"epssPercentile":0.40815,"ingestedAt":"2026-10-16T19:46:24.356Z","slug":"CVE-2026-74476","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.\n\n## Affected\n\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 0be3632597b8349d43a7dc4244b492dc62a05998`\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 04958dba44dc795dc79ce2fcbc117821bbbd6542`\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 5c1c15c540fc45820ce3033c319151ec891bc10a`\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb`\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < f9c1fff857e93be709c8b52ed1a643f37bd82c66`\n- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < d0d6415963040c401e7a7e4e482a698ba52448cb`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}