CVE-2026-74701
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0 Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
Affected versions
Linux kernel versions
4.10
and later are affected. Fixed in
5.10.265,
5.15.216,
6.1.183,
6.6.152,
6.12.104,
6.18.45,
7.1.9,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-74701?
CVE-2026-74701 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.10 onward and has been patched in 5.10.265, 5.15.216, 6.1.183 and others. CVE-2026-74701 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74701?
Yes. CVE-2026-74701 has been patched. Fixed versions include 5.10.265, 5.15.216, 6.1.183 and others. If you are running Linux kernel 4.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74701 actively exploited?
No. CVE-2026-74701 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.