CVE-2026-74473

vxlan: use pskb_network_may_pull() in route_shortcircuit()

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() in route_shortcircuit()

route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data.

However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length.

Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e4f67addf158f98f8197e08974966b18480dc751 to before c419af4924c1593500a40519730ed98575d04a3eAffected e4f67addf158f98f8197e08974966b18480dc751 to before 6bd0a3a1b5744166946f0c551a6665c3b46b05e4Affected e4f67addf158f98f8197e08974966b18480dc751 to before 214ba43faf106cb06cd3dd30999c5c809c868b53Affected e4f67addf158f98f8197e08974966b18480dc751 to before 42887be7c4cf283cce02cd0fb6411221167c8b6cAffected e4f67addf158f98f8197e08974966b18480dc751 to before aa0d31376d574ac858a40078431a77127bf04ee4Affected e4f67addf158f98f8197e08974966b18480dc751 to before ee799977d7941dbfb11049e17edd9eaf4f8820f7Affected e4f67addf158f98f8197e08974966b18480dc751 to before 4f3f96e771a20263635bb5e1307c112d613b4bbdAffected e4f67addf158f98f8197e08974966b18480dc751 to before 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fbAffected
LinuxLinux	3.8Affected before 3.8Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e4f67addf158f98f8197e08974966b18480dc751 to before c419af4924c1593500a40519730ed98575d04a3eAffected
e4f67addf158f98f8197e08974966b18480dc751 to before 6bd0a3a1b5744166946f0c551a6665c3b46b05e4Affected
e4f67addf158f98f8197e08974966b18480dc751 to before 214ba43faf106cb06cd3dd30999c5c809c868b53Affected
e4f67addf158f98f8197e08974966b18480dc751 to before 42887be7c4cf283cce02cd0fb6411221167c8b6cAffected
e4f67addf158f98f8197e08974966b18480dc751 to before aa0d31376d574ac858a40078431a77127bf04ee4Affected
e4f67addf158f98f8197e08974966b18480dc751 to before ee799977d7941dbfb11049e17edd9eaf4f8820f7Affected
e4f67addf158f98f8197e08974966b18480dc751 to before 4f3f96e771a20263635bb5e1307c112d613b4bbdAffected
e4f67addf158f98f8197e08974966b18480dc751 to before 26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fbAffected

LinuxLinux

3.8Affected
before 3.8Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.