CVE-2026-74743 Overview
CVE-2026-74743 is a Linux kernel vulnerability in the macvlan driver. During macvlan_init(), macvlan devices inherit hard_header_len from the lower device but leave needed_headroom and needed_tailroom at zero. When the underlying lower device requires additional header or trailer space, such as MACsec, IPsec, WireGuard, tunnels, or veth with RX headroom, upper layers fail to reserve sufficient socket buffer (skb) space. The resulting condition triggers reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() or macvlan_hard_header() prepends header data.
Critical Impact
The flaw enables memory corruption in the kernel network stack, which can result in denial of service or potential arbitrary code execution in kernel context.
Affected Products
- Linux kernel macvlan driver across multiple stable branches
- Systems configured with macvlan devices stacked over MACsec, IPsec, WireGuard, tunnels, or veth
- Container and virtualization deployments relying on macvlan networking
Discovery Timeline
- 2026-08-26 - CVE-2026-74743 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74743
Vulnerability Analysis
The defect resides in the macvlan network driver initialization path. macvlan_init() correctly propagates hard_header_len from the lower device but does not propagate needed_headroom or needed_tailroom. Upper layer protocols query these fields to determine how much space to reserve before and after packet payloads in the skb.
When the lower device requires extra bytes for encapsulation headers or authentication trailers, the macvlan device reports zero. Callers such as dev_hard_header() and macvlan_hard_header() then write header data into an skb that lacks reserved space. The kernel either reallocates the skb, underflows the headroom, or writes into memory that has already been freed. The last case produces a use-after-free that KASAN flags as slab-use-after-free.
Root Cause
The root cause is missing field inheritance during device initialization combined with missing event propagation. macvlan_init() does not copy needed_headroom and needed_tailroom from the lower device. macvlan_device_event() does not update attached macvlans when the lower device emits NETDEV_FEAT_CHANGE, so runtime changes to the lower device's headroom requirements are never reflected on the upper device.
Attack Vector
An attacker with the ability to send network traffic through a macvlan device stacked on an encapsulating lower device can trigger the header write path. Repeated transmission or reception with crafted packet sizes forces skb operations into the memory region beyond the allocated headroom. In container environments, an attacker on the network can reach macvlan interfaces exposed to guest workloads. Successful exploitation corrupts kernel slab memory, which impacts confidentiality, integrity, and availability of the host.
No public proof-of-concept has been released. Technical detail is available in the upstream commits referenced in the Kernel Commit for Security Updates and the Kernel Commit for Stability.
Detection Methods for CVE-2026-74743
Indicators of Compromise
- Kernel log entries reporting KASAN slab-use-after-free warnings referencing macvlan_hard_header or dev_hard_header
- Unexpected skb_under_panic or skb_over_panic messages in dmesg on hosts running macvlan over MACsec, IPsec, WireGuard, or tunnels
- Repeated skb reallocations reported by network counters on macvlan interfaces stacked over encapsulating devices
Detection Strategies
- Inventory all hosts running macvlan interfaces over lower devices that set needed_headroom or needed_tailroom, including MACsec, IPsec, WireGuard, GRE, VXLAN, and veth
- Monitor kernel ring buffers for headroom-related warnings and forward them to a centralized log platform
- Correlate kernel crash telemetry with macvlan configuration state to identify systems in scope
Monitoring Recommendations
- Ship dmesg and journald kernel messages to a SIEM and alert on KASAN, skb_under_panic, and skb_over_panic keywords
- Track kernel version distribution across the fleet and flag hosts running unpatched stable branches
- Alert on unexpected kernel oops or panic events on hosts operating container networking with macvlan
How to Mitigate CVE-2026-74743
Immediate Actions Required
- Apply the upstream stable kernel updates that add needed_headroom and needed_tailroom inheritance to macvlan_init()
- Prioritize hosts where macvlan is stacked on MACsec, IPsec, WireGuard, tunnel, or veth devices
- Reboot patched systems to load the corrected kernel and validate macvlan interface behavior
Patch Information
The fix inherits needed_headroom and needed_tailroom from the lower device in macvlan_init() and propagates updates in macvlan_device_event() on NETDEV_FEAT_CHANGE. Patches are available in the following commits: Kernel Commit 28afc87b, Kernel Commit 8cd90e85, Kernel Commit 8f6a05db, Kernel Commit 96fa90b7, Kernel Commit bc9a00fb, and Kernel Commit cef51860.
Workarounds
- Avoid stacking macvlan on lower devices that require non-zero needed_headroom or needed_tailroom until patches are applied
- Replace macvlan with alternative interfaces such as ipvlan or bridged veth where the topology permits
- Restrict untrusted workload access to macvlan interfaces bound to encapsulating lower devices
# Verify running kernel version and macvlan lower device relationships
uname -r
ip -d link show type macvlan
# Inspect headroom requirements advertised by candidate lower devices
ip -d link show dev <lowerdev>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
