« Volver al listado

CVE-2026-74473

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() in route_shortcircuit()

route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data.

However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length.

Leer descripción completaMostrar menos

Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota en kernel Linux (AV:N, PR:N, UI:N) explorable sin autenticación. Buffer underread en vxlan permite DoS o escalada de privilegios al desreferenciar memoria no validada en el contexto del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74473",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "c419af4924c1593500a40519730ed98575d04a3e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T13:17:52.060",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb->data.\n\nHowever, in vxlan_xmit(), skb->data points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."
    }
  ],
  "lastModified": "2026-08-19T17:21:04.623",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}