---
id: CVE-2026-74476
title: 'veth: convert frag_list skbs before running XDP'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  veth: convert frag_list skbs before running XDP

  A frag_list skb can reach veth with data_len set but nr_frags zero.
  veth_convert_skb_to_xdp_buff() only converts skbs t…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    0be3632597b8349d43a7dc4244b492dc62a05998
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    04958dba44dc795dc79ce2fcbc117821bbbd6542
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    5c1c15c540fc45820ce3033c319151ec891bc10a
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    f9c1fff857e93be709c8b52ed1a643f37bd82c66
  - >-
    Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 <
    d0d6415963040c401e7a7e4e482a698ba52448cb
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T18:57:33.426846Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:48.477Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74476'
references:
  - url: 'https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998'
  - url: 'https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542'
  - url: 'https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a'
  - url: 'https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb'
  - url: 'https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66'
  - url: 'https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb'
tags:
  - cve.org
epss: 0.00491
epssPercentile: 0.40815
ingestedAt: '2026-10-16T19:46:24.356Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero.
veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
locked, have frags[], or do not have enough headroom. It later uses
skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but
frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
metadata, walk an empty fragment entry, and crash in memcpy() from
__xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to
XDP, and only advertise XDP frags when the resulting skb has frags[].
skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
builds frags[] output with skb_add_rx_frag(), which is the
representation XDP multi-buffer expects.

## Affected

- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 0be3632597b8349d43a7dc4244b492dc62a05998`
- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 04958dba44dc795dc79ce2fcbc117821bbbd6542`
- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < 5c1c15c540fc45820ce3033c319151ec891bc10a`
- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb`
- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < f9c1fff857e93be709c8b52ed1a643f37bd82c66`
- `Linux >= 718a18a0c8a67f97781e40bdef7cdd055c430996 < d0d6415963040c401e7a7e4e482a698ba52448cb`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.