CVE-2026-74612: Linux kernel veth XDP skb length accounting corruption

CVE-2026-74612 · Severity: critical · CVSS 10 · Published 2026-08-22

A flaw in the Linux kernel's veth (virtual Ethernet) network driver causes incorrect memory length accounting when Extended Data Path (XDP) programs modify packet fragments. This can result in kernel memory being copied to user applications, exposing sensitive kernel pointers and data structures, or causing data corruption in received UDP packets.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-74612 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-74612 being exploited in the wild.
How severe is CVE-2026-74612?
Critical severity, with a CVSS score of 10, published 22 August 2026.
Which products and versions are affected?
Linux Kernel Vulnerable versions unspecified in advisory.
Is there a fix for CVE-2026-74612?
A patch was published on 2026-08-22: Fix included in advisory describing resolution to veth_xdp_rcv_skb() and bpf_xdp_pull_data() Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74612 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-74612?
Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a skb (socket buffer) length accounting bug in the veth driver's XDP fragment handling. When an XDP program adjusts fragment sizes, veth_xdp_rcv_skb() updates skb->data_len but fails to adjust skb->len accordingly, causing skb_headlen() to report a size larger than the actual linear area. Additionally, bpf_xdp_pull_data() can advance data_end while leaving fragments present, triggering incorrect assertions. The result is that __skb_datagram_iter() can copy kernel memory including struct skb_shared_info fields and kernel pointers to userspace. The fix properly synchronizes skb->len and skb->data_len before and after fragment adjustment, and uses skb_set_tail_pointer() instead of __skb_put() for non-linear skbs.

Affected products

  • Linux Linux kernel Vulnerable versions unspecified in advisory

Timeline

  • 2026-08-22: disclosed
  • 2026-08-22: patched: Fix included in advisory describing resolution to veth_xdp_rcv_skb() and bpf_xdp_pull_data()

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.