From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-74684: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Date: Sat, 22 Aug 2026 17:32:48 +0200 [thread overview]
Message-ID: <2026082232-CVE-2026-74684-9a3c@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
The commit 4f61f133f354 ("net: tap: NULL pointer derefence in
dev_parse_header_protocol when skb->dev is null") fixed a crash in
tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb().
This is required because virtio_net_hdr_to_skb() may invoke
dev_parse_header_protocol(), which dereferences skb->dev. Without the
assignment, a NULL pointer dereference can occur.
However, tap_get_user_xdp() still parses the virtio-net header before
assigning skb->dev. When the vhost TX path passes an XDP buffer containing
a GSO virtio-net header but the protocol is set to zero on purpose,
tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev
is still NULL, resulting in a crash.
Fix this by looking up the tap device and assigning skb->dev before calling
tun_vnet_hdr_to_skb(), matching the ordering already used in
tap_get_user(). Preserve the existing RCU read-side critical section across
dev_queue_xmit().
The Linux kernel CVE team has assigned CVE-2026-74684 to this issue.
Affected and fixed versions
===========================
Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 6.18.45 with commit 8b444b126cd8e4473e652f529753ed4dd1360a9c
Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.1.9 with commit 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b
Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.2 with commit 3874892dd27d5387aa9a06f58d9060f18f351d24
Issue introduced in 4.14.226 with commit ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d
Issue introduced in 4.19.181 with commit 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3
Issue introduced in 5.4.106 with commit ca278267d6cd9544645731732455b6b20cb0e895
Issue introduced in 5.10.24 with commit faa3baa2828c5e1c4374f3e60041f75c64f5fcb6
Issue introduced in 5.11.7 with commit 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-74684
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/tap.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c
https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b
https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24
reply other threads:[~2026-08-22 15:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026082232-CVE-2026-74684-9a3c@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.