CVE-2026-74310

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost/net: complete zerocopy ubufs only once

vhost-net initializes one ubuf_info per outstanding zerocopy TX

descriptor and hands it to the backend socket. The networking stack may

then clone a zerocopy skb before all skb references are released. For

example, batman-adv fragmentation reaches skb_split(), which calls

skb_zerocopy_clone() and increments the same ubuf_info refcount.

vhost_zerocopy_complete() currently treats every ubuf callback as a

completed vhost descriptor. It dereferences ubuf->ctx, writes the

descriptor completion state, and drops the vhost_net_ubuf_ref even when

the callback only releases a cloned skb reference. A backend reset can

therefore wait for and free the vhost_net_ubuf_ref while another cloned

skb still carries the same ubuf_info. A later completion then

dereferences the freed ubufs pointer.

KASAN reports the stale completion as:

BUG: KASAN: slab-use-after-free in vhost_zerocopy

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References