CVE-2026-74476
Last modified
CVE-2026-74476 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < 0be3632597b8349d43a7dc4244b492dc62a05998; >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < 04958dba44dc795dc79ce2fcbc117821bbbd6542; >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < 5c1c15c540fc45820ce3033c319151ec891bc10a; >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb; >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < f9c1fff857e93be709c8b52ed1a643f37bd82c66; >= 718a18a0c8a67f97781e40bdef7cdd055c430996, < d0d6415963040c401e7a7e4e482a698ba52448cb |
| Linux | Linux | 5.18 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-74476?
How severe is CVE-2026-74476?
How do I fix CVE-2026-74476?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-74470In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-74471In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-74472In the Linux kernel, the following vulnerability has been re…
- CVE-2026-74473In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-74474In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-74475In the Linux kernel, the following vulnerability has been re…10
- CVE-2026-74477In the Linux kernel, the following vulnerability has been re…
- CVE-2026-74478In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-74479In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-7448Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-74480In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2026-74481In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-74476?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST