CVE-2026-74701: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74701 Overview

CVE-2026-74701 is a Linux kernel vulnerability in the Open vSwitch (OVS) subsystem. The flaw resides in net/openvswitch/flow.c within the key_extract() function. When a packet arrives on an ARPHRD_NONE device such as a TUN interface, ovs_flow_key_extract() trusts the user-provided skb->protocol field. If that field equals ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is invoked without confirming the socket buffer holds at least ETH_HLEN (14) bytes of linear data. The subsequent __skb_pull() call triggers a kernel BUG(), producing a denial-of-service on the host.

Critical Impact
A local user with access to a TUN device can panic the kernel by injecting a short packet with a crafted skb->protocol value, causing a full system crash.

Affected Products

Linux kernel Open vSwitch module (net/openvswitch)
Kernel builds exposing TUN/TAP devices to unprivileged users through OVS bridges
Distributions shipping kernels prior to the referenced stable patches

Discovery Timeline

2026-08-22 - CVE-2026-74701 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74701

Vulnerability Analysis

The vulnerability is a kernel-space input validation error [CWE-20] in the Open vSwitch flow key extraction path. ovs_flow_key_extract() accepts a socket buffer (skb) from a TUN device and routes it through key_extract() when skb->protocol indicates a transparent Ethernet bridging frame (ETH_P_TEB). The extraction routine then calls __skb_pull() to advance past 2 * ETH_ALEN bytes of MAC addresses, followed by parse_ethertype() which pulls two additional bytes for the EtherType. Both operations assume the linear region contains a full Ethernet header.

When the linear area is smaller than 14 bytes, __skb_pull() fails the internal length assertion at include/linux/skbuff.h:2848 and invokes BUG(). The resulting oops terminates the offending kernel path and typically renders the host unusable.

Root Cause

The root cause is the absence of a check_header() call before dereferencing Ethernet fields. The code path trusts a user-controlled skb->protocol value set through the TUN write interface, then performs mandatory pulls without first ensuring linear data availability. The fix adds check_header(skb, ETH_HLEN) inside key_extract() before touching the Ethernet header.

Attack Vector

Exploitation requires local access and permission to write to a TUN character device, typically granted through CAP_NET_ADMIN or explicit device ownership. An attacker opens /dev/net/tun, configures the interface as ARPHRD_NONE, and writes a packet shorter than 14 bytes while setting skb->protocol to ETH_P_TEB (0x6558). Once the OVS datapath receives the frame through netdev_frame_hook() and ovs_vport_receive(), the malformed skb reaches key_extract() and the kernel panics.

The reported crash trace confirms the path:

kernel BUG at include/linux/skbuff.h:2848
RIP: key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933
ovs_flow_key_extract+0x419/0xa70
ovs_vport_receive+0x222/0x390
netdev_frame_hook+0x3e0/0x630
tun_get_user+0x2d0c/0x38e0

No remote exploitation path exists; the CVSS vector confirms local attack vector, low complexity, low privileges required, and high impact on confidentiality, integrity, and availability due to kernel-mode compromise.

Detection Methods for CVE-2026-74701

Indicators of Compromise

Kernel oops or panic messages referencing key_extract+, ovs_flow_key_extract, or tun_get_user in dmesg and /var/log/kern.log.
Unexpected host reboots on systems running Open vSwitch bridges bound to TUN/TAP interfaces.
Local processes opening /dev/net/tun and issuing writes shorter than 14 bytes on unusual interface types.

Detection Strategies

Monitor kernel ring buffer output for BUG at include/linux/skbuff.h signatures on OVS hosts and correlate with recent TUN device activity.
Enable audit rules on /dev/net/tun access (auditctl -w /dev/net/tun -p rwa) to trace which processes and users configure TUN interfaces.
Track kernel version and OVS module load state through configuration management tooling to identify unpatched hosts.

Monitoring Recommendations

Forward kern.crit and kern.alert facilities to centralized logging for correlation across the fleet.
Alert on process crashes involving ovs-vswitchd or hosts running virtual switches that lose network connectivity unexpectedly.
Baseline expected users of CAP_NET_ADMIN and alert on new principals gaining TUN interface control.

How to Mitigate CVE-2026-74701

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below and reboot affected hosts into the fixed kernel.
Restrict access to /dev/net/tun and CAP_NET_ADMIN to trusted service accounts only.
Audit container and virtualization workloads that expose TUN devices to guests or unprivileged users.

Patch Information

The fix adds a check_header() call in key_extract() before Ethernet header access. Merged commits are available in the stable trees: Kernel Patch 0b60b55, Kernel Patch 81f9b09, Kernel Patch 83147171, Kernel Patch 9b8cfbb5, Kernel Patch a8139285, Kernel Patch cf6f8b29, Kernel Patch d8bea341, and Kernel Patch e85278af. Deploy the distribution-provided kernel update as soon as it is available.

Workarounds

Unload the openvswitch kernel module on hosts that do not require OVS: modprobe -r openvswitch.
Remove or restrict TUN/TAP interfaces attached to OVS bridges until the patched kernel is deployed.
Enforce mandatory access control profiles (SELinux, AppArmor) that prevent non-administrative processes from opening /dev/net/tun.

bash

# Verify running kernel and OVS module state, then restrict TUN access
uname -r
lsmod | grep openvswitch
chmod 0600 /dev/net/tun
setfacl -m u:root:rw /dev/net/tun