CVE-2026-74476

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the veth driver where a frag list skb (socket buffer) can reach the driver with data len set but nr frags at zero. The function veth convert skb to xdp buff() fails to properly convert these buffers, leading to a situation where frag list data is exposed to XDP as if it were stored in frags[], even though frags[] is empty. Consequently, AF XDP copy mode may rely on this incorrect fragment metadata, causing the system to crash in memcpy() within the xsk rcv() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.