Executive brief
The Linux kernel's macvlan virtual network driver fails to properly reserve buffer space for packet headers and trailers when underlying network interfaces require extra space for their own encapsulation (such as IPsec, WireGuard, or tunneling). This can cause packet buffers to overflow, crash the system with memory corruption errors, or allow attackers to read or overwrite kernel memory.
Technical details
The vulnerability exists in the macvlan driver's initialization code, where macvlan devices inherit the hard_header_len parameter from their underlying network device but do not inherit needed_headroom and needed_tailroom. When a lower device requires additional buffer space for protocol headers or trailers (e.g., IPsec, WireGuard, macsec, tunnels, or veth with rx headroom), upper layers fail to reserve sufficient space when calculating packet buffer requirements. This results in skb (socket buffer) headroom underflows or KASAN slab-use-after-free crashes when headers are prepended or trailers appended. The fix adds inheritance of needed_headroom and needed_tailroom in macvlan_init() and propagates updates to attached macvlan devices during NETDEV_FEAT_CHANGE events. The vulnerability affects all Linux kernel versions since macvlan was introduced.
Affected products
- Linux Linux Kernel all versions with macvlan driver (2.6.11 and later)
Timeline
- 2026-08-26: disclosed: CVE-2026-74743 published
- 2026-08-23: patched: Patch committed upstream and to stable trees
- 2026-08-06: other: Fix authored by Eric Dumazet