CVE-2026-74474 vxlan: use pskb_network_may_pull() for transmit path header pulls
A missing network header offset check in the Linux kernel VXLAN transmit path can lead to memory corruption or crashes when processing fragmented packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74474?
CVE-2026-74474 is a critical memory corruption vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() for transmit path header pulls
In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys).
However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags.
Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.
Which versions are affected by CVE-2026-74474?
How do I fix CVE-2026-74474?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74474 being exploited?
There is no known exploitation of CVE-2026-74474 in the wild and no public exploit code.
Sources
Also known as AZL-96369, BELL-CVE-2026-74474, DEBIAN-CVE-2026-74474, GHSA-59jj-4qq4-v9f9, UBUNTU-CVE-2026-74474.