Critical 9.8Published Aug 15, 2026

CVE-2026-74473vxlan: use pskb_network_may_pull() in route_shortcircuit()

Updated under an hour ago (Oct 26, 2026, 7:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e4f67addf158f98f8197e08974966b18480dc751 before c419af4924c1593500a40519730ed98575d04a3e; from e4f67addf158f98f8197e08974966b18480dc751 before 6bd0a3a1b5744166946f0c551a6665c3b46b05e4; from e4f67addf158f98f8197e08974966b18480dc751 before 214ba43faf106cb06cd3dd30999c5c809c868b53; from e4f67addf158f98f8197e08974966b18480dc751 before 42887be7c4cf283cce02cd0fb6411221167c8b6c; from e4f67addf158f98f8197e08974966b18480dc751 before aa0d31376d574ac858a40078431a77127bf04ee4; from e4f67addf158f98f8197e08974966b18480dc751 before ee799977d7941dbfb11049e17edd9eaf4f8820f7; from e4f67addf158f98f8197e08974966b18480dc751 before 4f3f96e771a20263635bb5e1307c112d613b4bbd; from e4f67addf158f98f8197e08974966b18480dc751 before 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb	CNA record

References

References

https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e
https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4
https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53
https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c
https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4
https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7
https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd
https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.