CVE-2026-74701

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74701
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74701.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74701
Downstream
Published
2026-08-22T15:33:01.585Z
Modified
2026-08-24T11:47:21.827480517Z
Summary
net/openvswitch: check Ethernet header length in key_extract()
Details

In the Linux kernel, the following vulnerability has been resolved:

net/openvswitch: check Ethernet header length in key_extract()

When a packet arrives on an ARPHRDNONE device (e.g. TUN), ovsflowkeyextract() trusts the user-provided skb->protocol field: if it is ETHPTEB, the packet is classified as MACPROTOETHERNET and keyextract() is called without ensuring the skb has ETHHLEN (14) bytes of linear data. keyextract() unconditionally pulls 2 * ETHALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in _skbpull() when the linear area is too small.

kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:keyextract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovsflowkeyextract+0x419/0xa70 ovsvportreceive+0x222/0x390 netdevframehook+0x3e0/0x630 tungetuser+0x2d0c/0x38e0

Fixed by calling checkheader() in keyextract() before accessing the Ethernet header.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74701.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
217ac77a3c2524d999730b2a80b61fcc2d0f734a
Fixed
e85278afd4890dd190ba3c7a1b1a712b801c9fe1
Fixed
81f9b09f0ea3ba9ab966dd17e9f32625a14555e9
Fixed
831471718f6e19aed1a330b03b53190a90e06466
Fixed
d8bea341b183190ce6c055ab0e64ab78eb9a7290
Fixed
0b60b55652ba772b173dddc63f3851e1d2dd5927
Fixed
a8139285c8925efe59af28a9169bb2fda91bff15
Fixed
9b8cfbb58b85bfa7a78fac47fdc77396cd01f699
Fixed
cf6f8b29befb92173659bcef6a441d274947bfae

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74701.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
5.10.265
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.152
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.104
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.45
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74701.json"