CVE-2026-74473 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (w
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() in route_shortcircuit()
route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))
(or ipv6hdr), which checks if bytes are available starting from skb->data.
However, in vxlan_xmit(), skb->data points to the MAC header, so
skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)
only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of
IP header), leaving the rest of the IP header potentially un-pulled in non-linear
frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled
linear buffer length.
Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to
the length check to ensure the full network header is present in the linear buffer.
- 🔗 git.kernel.org/stable/c/c419af4924c1593500a40519730ed985…
- 🔗 git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3…
- 🔗 git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c80…
- 🔗 git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221…
- 🔗 git.kernel.org/stable/c/aa0d31376d574ac858a40078431a7712…
- 🔗 git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf…
- 🔗 git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d…
- 🔗 git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8…
```Code``` unterstützt. Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-09-22 | 2026-10-06 |
|---|---|---|
| ≥90 % | 491 | 353 |
| ≥50 % | 1475 | 1077 |
| ≥10 % | 0 | 2 |
| <10 % | 0 | 535 |
CVE-2026-74473 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (w
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if byt
Noch keine Analyse zu CVE-2026-74473
Sei der Erste: Einschätzung, Betroffenheit, Workaround oder PoC — mit Antworten im Thread.