CVE-2026-74705 Overview
CVE-2026-74705 is a use-after-free vulnerability in the Linux kernel's UDP tunnel segmentation code path. The flaw resides in the __skb_udp_tunnel_segment() function, which retrieves the User Datagram Protocol (UDP) header pointer before ensuring the tunnel header is present in the socket buffer (skb) head. When the subsequent pull operation reallocates skb->head, the previously saved UDP header pointer becomes dangling and may reference freed memory. The upstream fix reorders the operation so the UDP header is obtained after the pull completes.
Critical Impact
Remote attackers can trigger memory corruption in the kernel network stack via crafted UDP-encapsulated traffic, potentially enabling denial of service or memory disclosure across security boundaries.
Affected Products
- Linux kernel (upstream) with UDP tunnel segmentation offload support
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Systems using UDP-based tunneling protocols such as VXLAN, GENEVE, or FoU
Discovery Timeline
- 2026-08-22 - CVE-2026-74705 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74705
Vulnerability Analysis
The vulnerability exists in __skb_udp_tunnel_segment(), a helper invoked during Generic Segmentation Offload (GSO) processing for UDP-tunneled packets. The function captures a pointer to the UDP header early in its execution. It then calls a pull routine to guarantee that the tunnel header resides linearly within skb->head.
If the pull triggers reallocation of the skb head buffer, the original UDP header pointer becomes stale. Any subsequent dereference of that stale pointer constitutes a use-after-free condition [CWE-416]. Because the kernel operates on attacker-influenced network data, the freed region may be reused by concurrent allocations before the dereference, leading to unpredictable behavior.
Root Cause
The root cause is an ordering bug in pointer lifetime management. The code assumed that a pointer into skb->head remains valid across a pull operation, but the pull may relocate the underlying buffer. The fix repositions the UDP header retrieval to execute after the pull, guaranteeing the pointer references the current, valid buffer.
Attack Vector
An attacker sends crafted UDP tunnel traffic (for example, VXLAN or GENEVE frames) to a system with segmentation offload paths engaged. The malformed layout forces the pull path to reallocate skb->head, exercising the stale pointer condition. Because UDP tunneling is often processed on ingress without authentication, the attack vector is network-based and requires no privileges or user interaction.
The upstream patches referenced by commits 19d89b13, 1ae134c0, 5161e67c, 588d4a67, 64d322c2, 6a733a38, b3df61bb, and d0f86fb3 correct the ordering. See the Kernel Git Commit 19d89b13 for the reference implementation.
Detection Methods for CVE-2026-74705
Indicators of Compromise
- Unexplained kernel oops or panic entries in dmesg referencing __skb_udp_tunnel_segment or skb_gso_segment
- KASAN (Kernel Address Sanitizer) reports indicating use-after-free in UDP tunnel code paths
- Repeated soft lockups or network stack crashes correlated with inbound VXLAN, GENEVE, or FoU traffic
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free conditions during fuzzing of UDP tunnel ingress
- Compare running kernel versions against distribution security advisories referencing the listed stable commit hashes
- Correlate crash telemetry with packet capture data on interfaces terminating UDP tunnels
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized log store for anomaly review
- Monitor unexpected reboots or kernel taints on hypervisors, container hosts, and overlay-network gateways
- Track inbound UDP flows targeting tunnel destination ports (4789, 6081, and custom FoU ports) for volumetric or malformed traffic
How to Mitigate CVE-2026-74705
Immediate Actions Required
- Inventory all Linux systems running kernels that process UDP tunnel traffic, including hypervisors and Kubernetes nodes
- Apply the stable kernel updates containing the referenced commits from your distribution vendor
- Prioritize patching hosts exposed to untrusted network segments that terminate VXLAN, GENEWE, or FoU tunnels
Patch Information
The fix is available in multiple stable branches through commits 19d89b13, 1ae134c0, 5161e67c, 588d4a67, 64d322c2, 6a733a38, b3df61bb, and d0f86fb3. Rebuild custom kernels against a corrected tree or install the vendor package that incorporates the fix.
Workarounds
- Disable UDP tunnel segmentation offload where feasible using ethtool -K <iface> tx-udp_tnl-segmentation off and tx-udp_tnl-csum-segmentation off
- Restrict inbound UDP tunnel traffic at the network perimeter to trusted peers only
- Where overlay networks are not required, unload tunnel modules such as vxlan and geneve
# Disable UDP tunnel segmentation offload on an interface
sudo ethtool -K eth0 tx-udp_tnl-segmentation off
sudo ethtool -K eth0 tx-udp_tnl-csum-segmentation off
# Verify current offload state
ethtool -k eth0 | grep udp_tnl
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
