CVE-2026-74612

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the veth driver where non-linear skb fragments are exposed through an xdp buff. When an XDP program adjusts the fragment area, the veth xdp rcv skb() function fails to synchronize skb->len with skb->data len. This discrepancy can cause skb headlen() to report a size larger than the actual linear area. In specific UDP receive paths, the skb datagram iter() function may copy data beyond the linear tail into userspace, potentially exposing sensitive kernel information such as nr frags, xdp frags size, and kernel pointers from skb shinfo(skb)->frags[0]. Additionally, the use of skb put() in conjunction with bpf xdp pull data() can trigger an SKB LINEAR ASSERT() when fragments are still present.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.