CVE-2026-74476
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.
Risk Assessment
An attacker can cause a kernel panic by sending specially crafted packets, resulting in denial of service (DoS).
Recommendation
Apply the Linux kernel update containing the fix that routes non-linear skbs through skb_pp_cow_data() before exposing them to XDP.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.