From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E33B23D9532 for ; Sat, 22 Aug 2026 15:39:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787413181; cv=none; b=Clv8eTdH7Npr+PN1Yb9VDxnztO3qUnmYT5A1PXVLZrAFKK/zTU1RSnrcnOSzStWgRlkmtanU3vHFYQppNzaCzBVbmkRd0mC41mDl3afX75fD3tRmryQ0kE5D4LTlyLobAdyoyxm856hP6GeXlE8S+DCvWtD7Wyh0Yz2Ot+L0mlc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787413181; c=relaxed/simple; bh=qn2OicQRNNlkMxfOBE07lKc/ytxFn+TNbIP8nUNohNo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Dr3pzOJjf8TBFmAwblHSexOsU9vR5nwblGZ4s6KZD5+wcWA1wijAvm4KS2MN9EctXLYZufFFROKhUAX4nGAG15xqGKxKAaEp85qx/k0qhS5W8QO+ID90QG0lG5sBlYIFJVvFQ7zIPUPYzRzlKb8t+Ub87/BfGfFRArguiAaxRUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bkvW3z0I; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bkvW3z0I" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38F961F000E9; Sat, 22 Aug 2026 15:39:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787413179; bh=Hmh5dh/D1dk4txuLy6EgXQz43d07Hgus0wZJGINGxMU=; h=From:To:Cc:Subject:Date:Reply-To; b=bkvW3z0I1TeQFin5ot8wUrwuxVeQtvho8cCVtLPgfRVPAUQMGAunFThjvOEnaxXWD f9PMxokMbuCGKEtfarA1MBECEYCGU0NeXDFL8U3T+yaVlb2ePV14eR32ejkec3Gl+p gukYH1DiKiNTXQLwHzGTMKdY4VSscgr3PEF8IBbU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74684: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() Date: Sat, 22 Aug 2026 17:32:48 +0200 Message-ID: <2026082232-CVE-2026-74684-9a3c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3378; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=mu9CDlecyjz3SpdEefjyKuHM6ZrS/Yx5kri9mV5sPEU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmdB668Zf20yC5heZBMv8S1x1P5ZPTfcy06sW4xq2Odz RXrli7ujlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiIynOGBevvmC+d+KYjVS1e srl0JztH/8o5CxjmGX86KFNlukUrXO1r0ZvmsDmzGFrZAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit(). The Linux kernel CVE team has assigned CVE-2026-74684 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 6.18.45 with commit 8b444b126cd8e4473e652f529753ed4dd1360a9c Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.1.9 with commit 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.2 with commit 3874892dd27d5387aa9a06f58d9060f18f351d24 Issue introduced in 4.14.226 with commit ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d Issue introduced in 4.19.181 with commit 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 Issue introduced in 5.4.106 with commit ca278267d6cd9544645731732455b6b20cb0e895 Issue introduced in 5.10.24 with commit faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 Issue introduced in 5.11.7 with commit 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74684 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/tap.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24