CVE-2026-74705

udp: fix potential use-after-free in tunnel segmentation

State: Published
Severity: 10.0 Critical
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

udp: fix potential use-after-free in tunnel segmentation

__skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid.

Get the UDP header after the pull to avoid a potential use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 6a733a38b983d8c2e222f13968209010cf44de87Affected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 19d89b13a43640b2da2f277ee462d919d988cb6fAffected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before b3df61bb745eb5201eac22679a2839d4ccbf3442Affected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 1ae134c012e10384cdac420b5cc6e0615cde0b55Affected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 5161e67c561c4f28a5d9335a6e859b02511de92bAffected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 64d322c288577793eedd352b96ef75234ed380feAffected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 588d4a6795d99d080f74ef0b5f391ea8c453ae5dAffected dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before d0f86fb36eb260abd10007b62c9dcc1028e03e61Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 6a733a38b983d8c2e222f13968209010cf44de87Affected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 19d89b13a43640b2da2f277ee462d919d988cb6fAffected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before b3df61bb745eb5201eac22679a2839d4ccbf3442Affected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 1ae134c012e10384cdac420b5cc6e0615cde0b55Affected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 5161e67c561c4f28a5d9335a6e859b02511de92bAffected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 64d322c288577793eedd352b96ef75234ed380feAffected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before 588d4a6795d99d080f74ef0b5f391ea8c453ae5dAffected
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 to before d0f86fb36eb260abd10007b62c9dcc1028e03e61Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.