CVE-2026-74684: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74684 Overview

CVE-2026-74684 is a NULL pointer dereference vulnerability in the Linux kernel's net/tap subsystem. The flaw resides in tap_get_user_xdp(), which parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header with the protocol field deliberately zeroed, tun_vnet_hdr_to_skb() invokes dev_parse_header_protocol() on a NULL skb->dev. The result is a kernel crash. This is the second fix in the area; commit 4f61f133f354 addressed the same class of bug in tap_get_user() but left the XDP path unpatched.

Critical Impact
A local attacker with access to the vhost TX path can trigger a kernel NULL pointer dereference and crash the host, causing full system denial of service.

Affected Products

Linux kernel branches containing tap_get_user_xdp() prior to the fix
Systems using tap devices with vhost-net acceleration (typical KVM/QEMU virtualization hosts)
Distributions shipping kernels prior to the stable backports referenced in commits 15583b07, 164c31ee, 3874892d, and 8b444b12

Discovery Timeline

2026-08-22 - CVE-2026-74684 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74684

Vulnerability Analysis

The net/tap driver exposes user-space packet injection into the kernel networking stack. The XDP variant tap_get_user_xdp() builds an sk_buff from an XDP buffer supplied by vhost. Before the fix, the function called tun_vnet_hdr_to_skb() to translate the virtio-net header into skb metadata while skb->dev was still NULL.

tun_vnet_hdr_to_skb() may call virtio_net_hdr_to_skb(), which under certain header configurations invokes dev_parse_header_protocol(). That helper dereferences skb->dev unconditionally. When a caller submits a GSO-flagged virtio-net header with protocol set to zero, this code path is reached and the kernel dereferences a NULL pointer, panicking the host.

A prior fix (commit 4f61f133f354) addressed the identical crash in the non-XDP path tap_get_user() by reordering the device assignment. The XDP path was overlooked, leaving the vulnerability present when vhost uses XDP buffers.

Root Cause

The root cause is an ordering bug [CWE-476]. tap_get_user_xdp() parsed attacker-influenced virtio-net header fields before binding the skb to a valid tap net_device. The header parser assumes skb->dev is non-NULL, so any header content that triggers protocol parsing dereferences a NULL pointer.

Attack Vector

Exploitation requires local access to the vhost TX ring associated with a tap device, typically available to a VM guest or to a process with permission to open /dev/vhost-net and configure a tap interface. The attacker crafts an XDP buffer containing a virtio-net header with GSO flags set and protocol = 0. Submitting this buffer through the vhost TX path drives tap_get_user_xdp() into tun_vnet_hdr_to_skb() before skb->dev is set, triggering the NULL dereference and kernel panic. There is no memory disclosure or code execution primitive; impact is limited to host availability.

The fix looks up the tap device and assigns skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). The existing RCU read-side critical section across dev_queue_xmit() is preserved. See the upstream patches (kernel commit 15583b07, kernel commit 164c31ee, kernel commit 3874892d, and kernel commit 8b444b12) for the exact source changes.

Detection Methods for CVE-2026-74684

Indicators of Compromise

Kernel oops or panic entries in dmesg or /var/log/kern.log referencing tap_get_user_xdp, tun_vnet_hdr_to_skb, or dev_parse_header_protocol in the call stack
Unexplained host reboots on virtualization hosts running KVM/QEMU with vhost-net enabled
Guest VMs repeatedly submitting malformed virtio-net headers with protocol = 0 and GSO flags set

Detection Strategies

Monitor kernel crash telemetry for NULL pointer dereferences originating in the net/tap code path
Correlate host crashes with guest activity by tagging vhost/tap interfaces per VM and reviewing recent guest network configuration changes
Compare running kernel versions against the fixed stable branches referenced in the upstream commits

Monitoring Recommendations

Enable kdump on virtualization hosts to capture panic traces for post-incident analysis
Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: unable to handle or Oops messages containing tap-related symbols
Track kernel package versions across the fleet and flag hosts running unpatched builds

How to Mitigate CVE-2026-74684

Immediate Actions Required

Apply the vendor kernel update that includes the tap_get_user_xdp() fix and reboot affected hosts
Inventory all KVM/QEMU hypervisors using vhost-net with tap backends and prioritize patching multi-tenant hosts first
Restrict access to /dev/vhost-net and tap device creation to trusted users and services

Patch Information

The fix reorders operations in tap_get_user_xdp() so the tap device is resolved and skb->dev is assigned before tun_vnet_hdr_to_skb() is called. Upstream stable backports are available in commits 15583b07, 164c31ee, 3874892d, and 8b444b12. Apply the kernel package update supplied by your Linux distribution once it references these commits.

Workarounds

Disable vhost-net acceleration for untrusted guests until the host kernel is patched, forcing traffic through the slower user-space path that is not affected by the XDP ordering bug
Limit tap device creation and vhost access to privileged administrative accounts via udev rules and Linux capabilities
Where feasible, migrate untrusted workloads to patched hosts and quarantine unpatched hypervisors from production tenants

bash

# Verify the running kernel and confirm it includes the fix
uname -r

# Example: temporarily disable vhost-net for a libvirt guest by editing the domain XML
# <interface type='network'>
#   <driver name='qemu'/>  <!-- 'qemu' disables vhost; 'vhost' enables it -->
# </interface>

# Restrict access to the vhost-net device node
chmod 0600 /dev/vhost-net
chown root:root /dev/vhost-net