CVE-2026-74476

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero.

veth_convert_skb_to_xdp_buff() only converts skbs that are shared,

locked, have frags[], or do not have enough headroom. It later uses

skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and

xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but

frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment

metadata, walk an empty fragment entry, and crash in memcpy() from

__xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to

XDP, and only advertise XDP frags when the resulting skb has frags[].

skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()

builds frags[] output with skb_add_rx_frag(), which is the

representation XDP multi-buffer expects.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References