---
id: CVE-2026-74474
title: 'vxlan: use pskb_network_may_pull() for transmit path header pulls'
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  vxlan: use pskb_network_may_pull() for transmit path header pulls


  In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull()
  was

  being called to ver…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    371425d4be7795e9158388af9eee0201e6047410
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    6146901881f09ef063eb34ad389f63231f8486f5
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    94dee751aad627b3645d424b5d0c736d394573e9
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    7076a34b6e33315dc160b4612bfea1c597495585
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    b9553558b48db54ac9273e6b98d7263ef5c1a329
  - Linux 3.8
published: '2026-08-15'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T11:58:47.210Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74474'
references:
  - url: 'https://git.kernel.org/stable/c/371425d4be7795e9158388af9eee0201e6047410'
  - url: 'https://git.kernel.org/stable/c/bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4'
  - url: 'https://git.kernel.org/stable/c/6146901881f09ef063eb34ad389f63231f8486f5'
  - url: 'https://git.kernel.org/stable/c/94dee751aad627b3645d424b5d0c736d394573e9'
  - url: 'https://git.kernel.org/stable/c/7076a34b6e33315dc160b4612bfea1c597495585'
  - url: 'https://git.kernel.org/stable/c/b9553558b48db54ac9273e6b98d7263ef5c1a329'
tags:
  - cve.org
epss: 0.00721
epssPercentile: 0.51895
ingestedAt: '2026-09-14T15:23:07.456Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() for transmit path header pulls

In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was
being called to verify the availability of network layer headers (ARP, IPv6/ND,
IP/IPv6 MDB keys).

However, during transmit skb->data points to the MAC header, so skb_network_offset(skb)
is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data
rather than skb_network_offset(skb) + len, which can leave part of the network header
in non-linear frags.

Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly
account for the MAC header offset.

## Affected

- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 371425d4be7795e9158388af9eee0201e6047410`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < bb01c51950c3ff3c76acdd54b85ab38ccc2a8bb4`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 6146901881f09ef063eb34ad389f63231f8486f5`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 94dee751aad627b3645d424b5d0c736d394573e9`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 7076a34b6e33315dc160b4612bfea1c597495585`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < b9553558b48db54ac9273e6b98d7263ef5c1a329`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.