CVE-2026-74744 Overview
CVE-2026-74744 is a Linux kernel vulnerability in the ipvlan driver. The driver fails to inherit needed_headroom and needed_tailroom values from its underlying physical device (phy_dev) during initialization. When lower devices such as MACsec, IPsec, WireGuard, tunnel interfaces, or veth with RX headroom require additional space for headers or trailers, upper layers do not reserve sufficient buffer capacity. This triggers reallocation overhead, skb headroom underflows, and KASAN-detected slab-use-after-free crashes in dev_hard_header() and ipvlan_hard_header(). The bug affects Linux systems running containerized workloads and virtual network stacks that combine ipvlan with encrypted or tunneled underlays.
Critical Impact
Attackers with the ability to send network traffic through an ipvlan-backed interface can trigger use-after-free conditions in the kernel network path, enabling potential remote code execution or denial of service.
Affected Products
- Linux kernel with ipvlan driver enabled
- Container platforms using ipvlan-based networking (Docker, Kubernetes CNI plugins)
- Systems stacking ipvlan over MACsec, IPsec, WireGuard, veth, or tunnel devices
Discovery Timeline
- 2026-08-26 - CVE-2026-74744 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74744
Vulnerability Analysis
The ipvlan driver creates virtual network interfaces layered on top of a physical or virtual parent device. During ipvlan_init(), the driver copies hard_header_len from the parent but leaves needed_headroom and needed_tailroom at zero. Upper protocol layers rely on these fields to compute how much space to reserve at the front and end of each sk_buff before passing frames down the stack.
When the parent chain includes devices that prepend or append data, such as MACsec authentication headers, IPsec ESP trailers, WireGuard UDP encapsulation, or GRE tunnel headers, the reserved space is insufficient. The network stack must then reallocate the skb mid-transmission or write past buffer boundaries. Under KASAN instrumentation, the resulting access is flagged as a slab-use-after-free condition in dev_hard_header() and ipvlan_hard_header().
Root Cause
The ipvlan_init() function omits propagation of needed_headroom and needed_tailroom from phy_dev. The driver also fails to update these values on attached ipvlan child devices when the underlying device signals a NETDEV_FEAT_CHANGE event. Both omissions leave the ipvlan interface reporting zero reserved space while the actual transmit path demands headroom for lower-layer encapsulation.
Attack Vector
An attacker with network reachability to a host running ipvlan over an encapsulating underlay can craft packets that force the header preparation path to write into an under-reserved skb. The vulnerability is network-reachable and requires no authentication or user interaction. The vulnerability manifests during header prepending when lower devices append tailroom, producing memory corruption in kernel slab memory.
See the upstream fix commits referenced below for technical details on the corrected initialization and event propagation logic.
Detection Methods for CVE-2026-74744
Indicators of Compromise
- Kernel oops or panic messages referencing ipvlan_hard_header, dev_hard_header, or __skb_push in stack traces
- KASAN reports of slab-use-after-free in the network transmit path on hosts running ipvlan
- Unexpected skb reallocation warnings under high packet load through ipvlan interfaces
Detection Strategies
- Enumerate hosts where ipvlan interfaces are stacked on MACsec, IPsec, WireGuard, veth, or tunnel devices using ip -d link show
- Correlate kernel crash telemetry with workloads that generate traffic through container networks using ipvlan CNI plugins
- Review kernel version inventory to identify systems that predate the upstream fix commits
Monitoring Recommendations
- Forward kernel logs (dmesg, journalctl -k) to a centralized log platform and alert on network-stack oops signatures
- Track container host reboots and kernel panics against workload change windows to spot exploitation attempts
- Baseline packet drop and reallocation counters on ipvlan interfaces via ethtool -S and /proc/net/dev
How to Mitigate CVE-2026-74744
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the external commit list and reboot into the fixed kernel
- Inventory container hosts using ipvlan networking and prioritize those layered over encrypted or tunneled underlays
- Restrict untrusted network access to hosts pending patch deployment through firewall segmentation
Patch Information
The fix inherits needed_headroom and needed_tailroom from phy_dev in ipvlan_init() and propagates updates to attached ipvlans in ipvlan_device_event() on NETDEV_FEAT_CHANGE. Apply one of the following upstream commits corresponding to your kernel branch: Linux Kernel Commit 5c2ca77, Linux Kernel Commit 5f33188, Linux Kernel Commit af602c4, Linux Kernel Commit c0fbe31, Linux Kernel Commit e16e960, and Linux Kernel Commit f3c17ff.
Workarounds
- Reconfigure container networking to use macvlan or bridge mode where ipvlan is not required
- Avoid stacking ipvlan directly over MACsec, IPsec, WireGuard, or tunnel devices until the kernel is patched
- Where possible, place encryption or tunneling on a higher layer than the ipvlan interface to reduce lower-device headroom demand
# Verify running kernel version and ipvlan usage before applying mitigations
uname -r
ip -d link show type ipvlan
lsmod | grep ipvlan
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
