CVE-2026-74684

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference can occur in the tap get user xdp() function. This happens when the vhost TX path provides an XDP buffer with a GSO virtio-net header and the protocol is intentionally set to zero. In this scenario, the function calls tun vnet hdr to skb(), which may subsequently invoke dev parse header protocol(). Because skb->dev is not assigned before these calls, the system attempts to dereference a NULL pointer, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.