CVE-2026-74701

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Open vSwitch module where ovs flow key extract() trusts the user-provided skb->protocol field. When a packet arrives on an ARPHRD NONE device, such as a TUN device, and the protocol is set to ETH P TEB, the packet is classified as MAC PROTO ETHERNET. This leads to the key extract() function being called without verifying that the socket buffer (skb) contains the required ETH HLEN (14) bytes of linear data. Consequently, key extract() and parse ethertype() attempt to pull bytes for MAC addresses and ethertype, which triggers a kernel BUG in skb pull() if the linear area is insufficient.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.