CVE-2026-74612: Linux Kernel Information Disclosure Vulnerability

CVE-2026-74612 Overview

CVE-2026-74612 is a Linux kernel vulnerability in the virtual Ethernet (veth) driver's eXpress Data Path (XDP) fragment handling logic. The flaw resides in veth_xdp_rcv_skb(), where the socket buffer (skb) length accounting becomes desynchronized after an XDP program adjusts a non-linear fragment area. When a fragment shrinks, skb->len retains the old fragment contribution while skb->data_len is updated, causing skb_headlen() to report a linear area larger than actually exists. This allows out-of-bounds reads from kernel memory into userspace, exposing skb_shared_info contents including fragment metadata and kernel pointers.

Critical Impact
A crafted UDP receive path can leak nr_frags, xdp_frags_size, and kernel pointers from skb_shinfo(skb)->frags[0] to userspace, corrupting packet data and enabling kernel information disclosure.

Affected Products

Linux kernel builds with veth driver and XDP fragment support enabled
Stable kernel branches referenced by commits 0c3024af, 2f2a7f3f, 3205b065, 41b96667, cb6379fe, and cdf745b7
Container and virtualization workloads relying on veth pairs with XDP programs attached

Discovery Timeline

2026-08-22 - CVE-2026-74612 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74612

Vulnerability Analysis

The veth driver exposes non-linear skb fragments through an xdp_buff structure. When an XDP program modifies the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back into skb->data_len but never adjusts skb->len to reflect the new fragment contribution. This desynchronization causes skb_headlen(), defined as skb->len - skb->data_len, to return a value larger than the true linear area.

In the reproduced UDP receive path, __skb_datagram_iter() copied 1024 bytes beyond the linear tail into userspace. The overread began at struct skb_shared_info, exposing fragment counts, XDP fragment sizes, and a kernel pointer from skb_shinfo(skb)->frags[0]. Real packet payload was displaced by the same offset and truncated. A separate code path invoking bpf_xdp_pull_data() advances data_end while leaving fragments present, then trips SKB_LINEAR_ASSERT() inside the legacy __skb_put() call because the skb remains non-linear.

Root Cause

The root cause is missing arithmetic on skb->len when replacing skb->data_len after an XDP fragment adjustment. The fix subtracts the old data_len before overwriting it and adds the new data_len afterward, keeping skb->len and skb->data_len synchronized. The __skb_put() call is replaced with skb_set_tail_pointer() plus an explicit skb->len update, mirroring bpf_prog_run_generic_xdp() behavior for non-linear buffers.

Attack Vector

An attacker able to send crafted network traffic to a host running an XDP program on a veth interface can trigger the length desynchronization. A 60000-byte UDP datagram over a veth pair with MTU 64000, shortened by 1024 bytes in its fragment area, corrupted payloads in 10 of 10 test runs before the patch. The forced-tailroom reproducer additionally exercises bpf_xdp_pull_data() with fragments still present, triggering SKB_LINEAR_ASSERT() and a kernel panic. Refer to the Kernel Commit cdf745b7 for the reference fix.

Detection Methods for CVE-2026-74612

Indicators of Compromise

Kernel panic messages referencing SKB_LINEAR_ASSERT originating from veth_xdp_rcv_skb or bpf_xdp_pull_data call paths.
Userspace applications receiving UDP datagrams with truncated payloads and prefixed binary noise on veth-attached interfaces.
Unexpected dmesg warnings tied to skb_headlen mismatches on hosts with XDP programs loaded on veth pairs.

Detection Strategies

Audit loaded XDP programs on veth interfaces using bpftool prog show and ip link show type veth to enumerate exposure.
Correlate kernel oops and warning events with veth-attached container workloads that process UDP traffic at high MTU.
Compare running kernel versions against the stable commits listed in the kernel.org references to identify unpatched hosts.

Monitoring Recommendations

Forward kernel logs and eBPF verifier events to a centralized logging pipeline for correlation across container hosts.
Track anomalous UDP payload corruption reports from workloads that peer over veth interfaces.
Baseline XDP program load and attach events per host so new or modified attachments are reviewed promptly.

How to Mitigate CVE-2026-74612

Immediate Actions Required

Apply the upstream kernel patches referenced by commits cdf745b7, cb6379fe, 41b96667, 3205b065, 2f2a7f3f, and 0c3024af from the kernel.org stable tree.
Inventory container hosts running XDP programs attached to veth devices and prioritize them for patching.
Restrict the ability to load XDP programs to trusted administrators by enforcing CAP_BPF and CAP_NET_ADMIN boundaries.

Patch Information

The fix is available across multiple Linux stable branches. The patch subtracts the previous data_len from skb->len before assigning the new fragment size and then adds the updated data_len back, preserving the invariant between the two fields. It also replaces __skb_put() with skb_set_tail_pointer() and an explicit skb->len update so bpf_xdp_pull_data() no longer trips SKB_LINEAR_ASSERT() when fragments remain. Rebuild custom kernels from the referenced commits or install the distribution-provided update.

Workarounds

Detach non-essential XDP programs from veth interfaces until the kernel patch is deployed.
Reduce veth MTU below the fragmentation threshold to limit non-linear skb construction on affected paths.
Disable XDP fragment support in workloads that do not require multi-buffer XDP by configuring the loader without the XDP_FLAGS_HAVE_FRAGS feature.

bash

# Detach XDP program from a veth interface as a temporary mitigation
ip link set dev veth0 xdp off

# Verify no XDP program remains attached
ip -details link show dev veth0 | grep -i xdp

# Confirm the running kernel includes the fix commit
zcat /proc/config.gz | grep CONFIG_VETH
uname -r