CVE-2026-74701 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
net/openvswitch: check Ethernet header length in key_extract()
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified within the Linux kernel's Open vSwitch implementation represents a critical input validation failure that can lead to local denial of service conditions through kernel panic or crash. The flaw resides specifically in the net/openvswitch/flow.c module, where the function key_extract() processes incoming network packets for flow classification and switching decisions. This issue is particularly relevant when handling traffic on devices configured with ARPHRD_NONE hardware type, such as TUN interfaces which operate at layer two without standard Ethernet header assumptions by default. The core technical deficiency lies in the unconditional trust placed in user-provided data structures, specifically the skb->protocol field provided by userspace applications interacting with these virtual network devices.
When a packet arrives on an ARPHRD_NONE device and the protocol is identified as ETH_P_TEB (Ethernet Tunneling), the kernel classifies it under MAC_PROTO_ETHERNET logic. Consequently, key_extract() proceeds to parse Ethernet headers without verifying that sufficient linear data exists within the socket buffer structure. The function attempts to extract source and destination MAC addresses by pulling 2 * ETH_ALEN bytes from the packet header. Additionally, subsequent parsing functions like parse_ethertype() attempt to pull an additional two bytes for the EtherType field. These operations rely on __skb_pull(), which validates that the requested data length does not exceed the available linear area of the sk_buff structure. When the incoming packet lacks the required ETH_HLEN (14 bytes) of contiguous header data, this validation fails and triggers a kernel BUG assertion at include/linux/skbuff.h line 2848.
The operational impact of this vulnerability is severe for system stability. An attacker or misconfigured application capable of sending crafted packets with insufficient linear headers to an Open vSwitch port on a TUN interface can trigger the aforementioned kernel panic. This results in an immediate denial of service, causing the affected Linux host to crash and reboot if not protected by automatic restart mechanisms. The vulnerability affects systems running vulnerable versions of the Linux kernel where openvswitch modules are enabled and utilized for virtual networking or container orchestration backends that rely on TUN/TAP interfaces. It does not typically allow remote code execution but serves as a potent vector for local privilege escalation via denial-of-service if combined with other vulnerabilities, or simply causes significant service disruption in production environments relying on Open vSwitch for network segmentation and policy enforcement.
From a classification perspective, this flaw aligns with CWE-20 Improper Input Validation, specifically the failure to verify that input data meets expected structural constraints before processing. It also relates to CWE-134 Use of Externally-Controlled Format String or similar buffer handling errors where assumptions about packet structure are not validated against actual memory layout. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Defense Evasion through Denial of Service techniques, allowing an adversary to disrupt availability by exploiting kernel-level assertion failures without needing elevated privileges initially if the input source is accessible via network or local socket interfaces exposed to untrusted users.
The resolution implemented involves integrating a check_header() call within key_extract() prior to any access attempts on the Ethernet header fields. This ensures that the necessary linear data length is present before attempting memory pulls, thereby preventing the out-of-bounds condition in __skb_pull(). To mitigate this risk immediately for systems not yet patched, administrators should restrict access to TUN interfaces and Open vSwitch ports to trusted userspace processes only. Implementing strict egress filtering on virtual network devices can also reduce exposure by dropping packets that do conform to expected Ethernet frame sizes before they reach the vulnerable kernel code paths. Regularly updating the Linux kernel and openvswitch packages is essential, as this fix addresses a fundamental assumption in packet processing logic that was previously left unchecked against malformed or truncated inputs from userspace applications.