CVE-2026-74476

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skbisnonlinear() to decide whether to set XDPFLAGSHASFRAGS and xdpfrags_size.

That exposes fraglist data to XDP as if it were stored in frags[], but frags[] is empty. AFXDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from _xskrcv().

Route non-linear skbs through skbppcowdata() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skbcopybits() already handles fraglist input, and skbppcowdata() builds frags[] output with skbaddrxfrag(), which is the representation XDP multi-buffer expects.