CVE-2026-74476: veth: convert frag_list skbs before running XDP

CVE-2026-74476: veth: convert frag_list skbs before running XDP

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero.
veth_convert_skb_to_xdp_buff() only converts skbs that are shared,
locked, have frags[], or do not have enough headroom. It later uses
skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but
frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
metadata, walk an empty fragment entry, and crash in memcpy() from
__xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to
XDP, and only advertise XDP frags when the resulting skb has frags[].
skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
builds frags[] output with skb_add_rx_frag(), which is the
representation XDP multi-buffer expects.

The Linux kernel CVE team has assigned CVE-2026-74476 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit 718a18a0c8a67f97781e40bdef7cdd055c430996 and fixed in 6.12.103 with commit 5c1c15c540fc45820ce3033c319151ec891bc10a
	Issue introduced in 5.18 with commit 718a18a0c8a67f97781e40bdef7cdd055c430996 and fixed in 6.18.44 with commit b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb
	Issue introduced in 5.18 with commit 718a18a0c8a67f97781e40bdef7cdd055c430996 and fixed in 7.1.8 with commit f9c1fff857e93be709c8b52ed1a643f37bd82c66
	Issue introduced in 5.18 with commit 718a18a0c8a67f97781e40bdef7cdd055c430996 and fixed in 7.2-rc6 with commit d0d6415963040c401e7a7e4e482a698ba52448cb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74476
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/veth.c
	net/core/skbuff.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a
	https://git.kernel.org/stable/c/b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb
	https://git.kernel.org/stable/c/f9c1fff857e93be709c8b52ed1a643f37bd82c66
	https://git.kernel.org/stable/c/d0d6415963040c401e7a7e4e482a698ba52448cb