{"id":"CVE-2026-74476","state":"PUBLISHED","title":"veth: convert frag_list skbs before running XDP","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects.","publishedAt":"2026-08-15T12:27:11.309Z","updatedAt":"2026-10-16T19:05:48.477Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"0be3632597b8349d43a7dc4244b492dc62a05998","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"04958dba44dc795dc79ce2fcbc117821bbbd6542","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"5c1c15c540fc45820ce3033c319151ec891bc10a","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"f9c1fff857e93be709c8b52ed1a643f37bd82c66","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"d0d6415963040c401e7a7e4e482a698ba52448cb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/veth.c","net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.153","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/veth.c","net/core/skbuff.c"]}],"references":["https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998","https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542","https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a","https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66","https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74476.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74476","state":"PUBLISHED","datePublished":"2026-08-15T12:27:11.309Z","dateUpdated":"2026-10-16T19:05:48.477Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.903Z"},"containers":{"cna":{"title":"veth: convert frag_list skbs before running XDP","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: convert frag_list skbs before running XDP\n\nA frag_list skb can reach veth with data_len set but nr_frags zero.\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,\nlocked, have frags[], or do not have enough headroom. It later uses\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and\nxdp_frags_size.\n\nThat exposes frag_list data to XDP as if it were stored in frags[], but\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment\nmetadata, walk an empty fragment entry, and crash in memcpy() from\n__xsk_rcv().\n\nRoute non-linear skbs through skb_pp_cow_data() before exposing them to\nXDP, and only advertise XDP frags when the resulting skb has frags[].\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()\nbuilds frags[] output with skb_add_rx_frag(), which is the\nrepresentation XDP multi-buffer expects."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"0be3632597b8349d43a7dc4244b492dc62a05998","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"04958dba44dc795dc79ce2fcbc117821bbbd6542","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"5c1c15c540fc45820ce3033c319151ec891bc10a","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"f9c1fff857e93be709c8b52ed1a643f37bd82c66","versionType":"git"},{"version":"718a18a0c8a67f97781e40bdef7cdd055c430996","status":"affected","lessThan":"d0d6415963040c401e7a7e4e482a698ba52448cb","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/veth.c","net/core/skbuff.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.153","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/veth.c","net/core/skbuff.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/0be3632597b8349d43a7dc4244b492dc62a05998"},{"url":"https://git.kernel.org/stable/c/04958dba44dc795dc79ce2fcbc117821bbbd6542"},{"url":"https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a"},{"url":"https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb"},{"url":"https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66"},{"url":"https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a received skb traverses veth XDP processing; in cloud/container deployments (e.g. Cloudflare-style edge nodes) remote traffic routed to a veth peer with XDP+AF_XDP can deliver the malformed frag_list skb without local access.\nAC:L - An attacker can reliably supply the required frag_list skb (data_len>0, nr_frags=0) by transmitting from the veth peer via sockets or GRO aggregation, controlling packet size, timing, and content without depending on uncontrollable kernel state.\nPR:N - Remote exploitation needs no attacker privileges when ingress traffic reaches a veth that already has an XDP program redirecting to an AF_XDP socket; only network-delivered skbs trigger veth_convert_skb_to_xdp_buff() and the faulty __xsk_rcv() path.\nUI:N - No victim user action is required beyond normal network traffic reaching the veth interface; exploitation is automatic once a qualifying frag_list skb is received and redirected to AF_XDP copy mode.\nS:U - The flaw causes kernel memory reads and crashes within the host kernel security boundary; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - Bogus XDP_FLAGS_HAS_FRAGS metadata makes __xsk_rcv() memcpy from uninitialized frags[] entries via skb_frag_address(), enabling out-of-bounds kernel memory reads into the AF_XDP receive buffer before faulting.\nI:N - The failure mode is a kernel-side memcpy read using invalid fragment metadata; data is copied into the attacker's AF_XDP ring buffer rather than corrupting kernel or other tenants' memory for integrity purposes.\nA:H - The commit and code path confirm a kernel crash when __xsk_rcv() follows bogus fragment metadata and memcpy faults on an invalid frags[] source address, causing oops/panic and denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:47:22.315Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74476","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T18:57:33.426846Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:05:48.477Z"}}]}}}