From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC68B3E95B1 for ; Sat, 15 Aug 2026 12:28:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786796934; cv=none; b=j/aJXwQVOOKQ7au83n8lMdTu80bv56bhRD87fZ0/IzdCHJkO4uR0bNx70Vj4er6dN24qEc+yBWcfac07XA7obtBjSMuLMwj3uy0MI9XYX5qIFvqub8GSiS1CSegsetikW8FZ9LA8aEPast7Tx1w5tKBUKHwVRPU+L8UpHK/hMKI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786796934; c=relaxed/simple; bh=6GZWIuALmqiFsd24uETZ7pCkI3mb35zMMK0bzkdlc1U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SUXIz87CncqJP8cbHKBcUMZpcppDZMM/j2rZikVHEB9U5wODbDIWN9BMstyfeeDp5MB6onmd6LTv08CABU7X1Twi2NDvn1v2phWhQB9KF5ZRMtQ+mOim2z3/LVgm3WUAn/J1OfBCswkJScaseWJkhMDcF9WlSFZsaE5CDlkRxE0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uruhIGvw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uruhIGvw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10C981F000E9; Sat, 15 Aug 2026 12:28:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786796933; bh=50Nf8akDdRT/XH+hMrX9NNTBkP73fIlbSWGC2N98jhM=; h=From:To:Cc:Subject:Date:Reply-To; b=uruhIGvwtAdnuPulT70T5PieVGi2Xn1czCR1pWAsT1qdZhYs1k6HBEmlefS+kh1Jo USdoBN/vjmFY8VtaahextuR0aDnGZGFRgbJutxbpYCDwUeoo30rx0UW4zdd7VvqUTy Zf4bRuLJUY371ivaszRmCjf6pFjrjcVpg1JZQfjI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() Date: Sat, 15 Aug 2026 21:25:54 +0900 Message-ID: <2026081535-CVE-2026-74473-9c71@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3192; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=cob3vFoAQTjcwjv8yt1YrrS0i7ovDqVqFCia8DUegkk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNUftdF2plvwxYLs98kuHvjfPT5ut+y260iIk9PefPO 657XdN/dsSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEZmoxzFP05TPrLzkScal0 TtGDA01HTrge92KYn5Y93d+ubVLQsZDnMQJ5c6demdHyCwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer. The Linux kernel CVE team has assigned CVE-2026-74473 to this issue. Affected and fixed versions =========================== Issue introduced in 3.8 with commit e4f67addf158f98f8197e08974966b18480dc751 and fixed in 6.6.151 with commit 42887be7c4cf283cce02cd0fb6411221167c8b6c Issue introduced in 3.8 with commit e4f67addf158f98f8197e08974966b18480dc751 and fixed in 6.12.103 with commit aa0d31376d574ac858a40078431a77127bf04ee4 Issue introduced in 3.8 with commit e4f67addf158f98f8197e08974966b18480dc751 and fixed in 6.18.44 with commit ee799977d7941dbfb11049e17edd9eaf4f8820f7 Issue introduced in 3.8 with commit e4f67addf158f98f8197e08974966b18480dc751 and fixed in 7.1.8 with commit 4f3f96e771a20263635bb5e1307c112d613b4bbd Issue introduced in 3.8 with commit e4f67addf158f98f8197e08974966b18480dc751 and fixed in 7.2-rc6 with commit 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74473 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/vxlan/vxlan_core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4 https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7 https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb