Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-74684

net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 924a9bc362a5223cd448ca08c3dde21235adc310 to < 61dd022c55c7307ec119e5672cb141cccbecf3b1affected
  • 924a9bc362a5223cd448ca08c3dde21235adc310 to < 15583b07fd691a844fbf7b3ad612cdc9e9a657c0affected
  • 924a9bc362a5223cd448ca08c3dde21235adc310 to < 8b444b126cd8e4473e652f529753ed4dd1360a9caffected
  • 924a9bc362a5223cd448ca08c3dde21235adc310 to < 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379baffected
  • 924a9bc362a5223cd448ca08c3dde21235adc310 to < 3874892dd27d5387aa9a06f58d9060f18f351d24affected
  • ea3fb2ce5fa794d02135f5c079e05cd6fc3f545daffected
  • 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3affected
  • ca278267d6cd9544645731732455b6b20cb0e895affected
  • faa3baa2828c5e1c4374f3e60041f75c64f5fcb6affected
  • 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748affected
  • 4.14.226 to < 4.15affected
  • 4.19.181 to < 4.20affected
  • 5.4.106 to < 5.5affected
  • 5.10.24 to < 5.11affected
  • 5.11.7 to < 5.12affected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.105 to ≤ 6.12.*unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References