Executive brief
The Linux kernel's UDP tunnel segmentation function contains a use-after-free vulnerability in network packet handling. An attacker with network access could exploit this flaw to cause kernel crashes or potentially execute arbitrary code on affected systems, disrupting network services and compromising system stability.
Technical details
The vulnerability exists in the __skb_udp_tunnel_segment() function in net/ipv4/udp_offload.c. The function retrieves a UDP header pointer before ensuring the tunnel header is present in the socket buffer (skb) head. A subsequent pskb_may_pull() call may reallocate the skb->head, invalidating the saved UDP header pointer, leading to a use-after-free condition. The fix reorders the operations to obtain the UDP header pointer after the pull operation completes. This is a memory safety issue in kernel packet processing that is network-reachable with no authentication required.
Affected products
- Linux Linux kernel affected versions spanning from 2.6.11 through current mainline (6.x series); upstream fix commit d0f86fb36eb260abd10007b62c9dcc1028e03e61
Timeline
- 2026-08-22: disclosed: CVE-2026-74705 published
- 2026-08-19: patched: Fix committed to stable kernel trees