CVE-2026-74743 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's macvlan subsystem facilitates the creation of virtual network interfaces that operate at layer two, allowing multiple MAC addresses to be associated with a single physical device or bridge. A critical architectural flaw existed within this implementation regarding how memory buffers for network packets are prepared before transmission and reception. Specifically, while the initialization routine correctly inherited the hard_header_len from the underlying lower-level device, it failed to propagate the needed_headroom and needed_tailroom parameters. These two metrics define the amount of extra space required in a socket buffer skb prior to header insertion or trailer appending by specific network protocols such as MACsec IPsec WireGuard tunnels or veth interfaces with rx headroom requirements. By leaving these values at zero, the macvlan device did not account for the spatial overhead demanded by its lower-layer dependencies during packet construction phases.
This oversight leads to significant operational instability and potential security vulnerabilities within the networking stack. When upper layers of the kernel calculate the necessary space for a network packet they assume that sufficient headroom exists based on the macvlan interface's own zeroed values rather than the actual requirements of the underlying hardware or protocol handler. Consequently, when dev_hard_header or macvlan_hard_header attempts to prepend header data, it may write beyond the allocated boundaries of the socket buffer leading to an skb headroom underflow. This memory corruption can trigger kernel panics or result in slab-use-after-free errors detected by Kernel Address Sanitizer KASAN tools during runtime testing. The reallocation overhead caused by insufficient initial allocation also degrades network performance and increases latency due to frequent memory management operations attempting to correct the deficit dynamically after the fact.
From a vulnerability classification perspective this issue aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow scenarios where input data exceeds allocated space although in this context it manifests as an underflow or insufficient allocation leading to out-of-bounds writes when headers are prepended. It also relates to CWE-400 Uncontrolled Resource Consumption due to the unnecessary reallocation overhead and potential denial of service through kernel crashes. In terms of attack surface mapping according to MITRE ATT&CK this flaw could potentially be leveraged in conjunction with other vulnerabilities for privilege escalation or remote code execution if an attacker can trigger specific packet structures that exploit the memory corruption, although it primarily serves as a stability issue exploitable via local denial of service conditions by flooding interfaces with malformed traffic patterns.
The resolution involves modifying macvlan_init to explicitly inherit needed_headroom and needed_tailroom from the lower device ensuring that socket buffers are allocated with adequate space for all required headers and trailers before transmission begins. Furthermore the fix extends to macvlan_device_event which now propagates updates to these parameters when NETDEV_FEAT_CHANGE events occur on the underlying interface. This ensures dynamic consistency if the characteristics of the lower device change during runtime such as enabling or disabling specific offload features that alter header requirements. Administrators and developers should ensure their kernels are updated with this patch applied to prevent potential kernel crashes and maintain network performance integrity especially in environments utilizing complex virtualization setups involving macsec ipsec wireguard or specialized veth configurations where precise memory management is critical for secure operation.