CVE-2026-74478

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the vector mmsg rx() function. When a packet is discarded because its overlay header fails the verify header() check, the system frees the socket buffer (skb) and continues the loop without clearing the consumed slot or advancing the cursors. Consequently, the next iteration processes the same slot, attempting to free the already freed skb, which leads to a refcount underflow and a use-after-free condition in the RX path. This can be triggered without authentication by any peer using GRE or L2TPv3 transports, as these transports return negative values upon cookie or session-id mismatches.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.