{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74612 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74612 is a critical vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74612 and fix it if it is affected.\n\nWhat it is: CVE-2026-74612 is a critical vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74612 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74612/ (Markdown: https://insights.sbomify.com/CVE-2026-74612/index.md)","id":"CVE-2026-74612","markdown":"https://insights.sbomify.com/CVE-2026-74612/index.md","name":"CVE-2026-74612","record":{"aliases":["AZL-97053","BELL-CVE-2026-74612","DEBIAN-CVE-2026-74612","GHSA-pg5f-gw23-248r","SUSE-SU-2026:24021-1","SUSE-SU-2026:24039-1","SUSE-SU-2026:24057-1","SUSE-SU-2026:24073-1","SUSE-SU-2026:4434-1","SUSE-SU-2026:4538-1","UBUNTU-CVE-2026-74612"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A Linux kernel veth driver flaw allows attackers to read kernel memory and cause crashes via crafted UDP packets with XDP adjustments.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":10,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix skb length accounting after XDP frag adjustment\n\nveth exposes non-linear skb fragments through an xdp_buff. If an XDP\nprogram adjusts the fragment area, veth_xdp_rcv_skb() copies\nxdp_frags_size back to skb-\u003edata_len but leaves skb-\u003elen containing the\nold fragment contribution.\n\nAfter a fragment shrink, this makes skb_headlen() larger than the actual\nlinear area. In the reproduced UDP receive path, __skb_datagram_iter()\ncopied 1024 bytes past the actual linear tail to userspace, starting at\nstruct skb_shared_info. The copied bytes included the affected skb's\nnr_frags, xdp_frags_size, and a kernel pointer from\nskb_shinfo(skb)-\u003efrags[0]. Real packet data was displaced by the same\namount and truncated at the end.\n\nSubtract the old data_len before replacing it and add the new data_len\nafterwards, keeping skb-\u003elen and skb-\u003edata_len synchronized.\n\nAdditionally, bpf_xdp_pull_data() can advance data_end while leaving\nfrags present. The skb is then still non-linear, so the old\n__skb_put(skb, off) triggers SKB_LINEAR_ASSERT().\n\nUse skb_set_tail_pointer() and update skb-\u003elen explicitly instead,\nfollowing bpf_prog_run_generic_xdp(). Unlike __skb_put(),\nskb_set_tail_pointer() does not require a linear skb.\n\nA 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by\n1024 bytes from its fragment area. Before the fix, all 10 runs produced\ncorrupted payloads. After the fix, all 10 runs matched the expected\npayload exactly. A forced-tailroom reproducer also exercises\nbpf_xdp_pull_data() with frags still present; the old code triggers\nSKB_LINEAR_ASSERT(), while this fix passes 10/10 runs.","ecosystems":["SUSE:Linux Enterprise Live Patching 15 SP7","SUSE:Linux Micro 6.0","SUSE:Linux Micro 6.1"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"veth: fix skb length accounting after XDP frag adjustment","id":"CVE-2026-74612","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":6,"n_references":6,"next":{"headline":"vsock/virtio: avoid refilling the RX queue after teardown","id":"CVE-2026-74613"},"packages":[{"ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","fixed":["2-150700.2.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-SLE15-SP7-RT_Update_20","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP7-RT_Update_20\u0026distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP7","source":"SUSE-SU-2026:4434-1"},{"ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","fixed":["2-150700.2.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-SLE15-SP7_Update_21","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP7_Update_21\u0026distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP7","source":"SUSE-SU-2026:4538-1"},{"ecosystem":"SUSE:Linux Micro 6.0","fixed":["2-1.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-MICRO-6-0-RT_Update_29","purl":"pkg:rpm/suse/kernel-livepatch-MICRO-6-0-RT_Update_29\u0026distro=SUSE%20Linux%20Micro%206.0","source":"SUSE-SU-2026:24057-1"},{"ecosystem":"SUSE:Linux Micro 6.0","fixed":["2-1.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-MICRO-6-0_Update_29","purl":"pkg:rpm/suse/kernel-livepatch-MICRO-6-0_Update_29\u0026distro=SUSE%20Linux%20Micro%206.0","source":"SUSE-SU-2026:24073-1"},{"ecosystem":"SUSE:Linux Micro 6.1","fixed":["2-1.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-MICRO-6-0-RT_Update_29","purl":"pkg:rpm/suse/kernel-livepatch-MICRO-6-0-RT_Update_29\u0026distro=SUSE%20Linux%20Micro%206.1","source":"SUSE-SU-2026:24039-1"},{"ecosystem":"SUSE:Linux Micro 6.1","fixed":["2-1.1"],"introduced":["0"],"last_affected":[],"package":"kernel-livepatch-MICRO-6-0_Update_29","purl":"pkg:rpm/suse/kernel-livepatch-MICRO-6-0_Update_29\u0026distro=SUSE%20Linux%20Micro%206.1","source":"SUSE-SU-2026:24021-1"}],"prev":{"headline":"tls: rx: restore msg_iter before TLS 1.3 optimistic retry","id":"CVE-2026-74611"},"products":["Linux"],"published":"2026-08-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"A Linux kernel veth driver flaw allows attackers to read kernel memory and cause crashes via crafted UDP packets with XDP adjustments.","url":"https://insights.sbomify.com/CVE-2026-74612/"}