CVE-2026-74744 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Linux kernel's IPvLAN subsystem stems from an incomplete initialization of network device buffer requirements, specifically concerning headroom and tailroom allocation for socket buffers. During the initialization phase via ipvlan_init(), the system correctly inherits the hard_header_len attribute from the underlying physical device or phy_dev. However, it fails to propagate the corresponding needed_headroom and needed_tailroom values, leaving them at their default zero state. This discrepancy creates a critical misalignment between the actual buffer space required by lower-layer protocols and what the upper layers believe is available for packet processing operations.
The operational impact of this flaw manifests when network traffic traverses through IPvLAN interfaces that are stacked over devices requiring additional header or trailer space. Protocols such as MACsec, IPsec, WireGuard, various tunneling mechanisms, and virtual ethernet pairs with specific receive headroom configurations all demand extra buffer space to prepend encryption headers, append trailers, or handle encapsulation metadata. Because the IPvLAN device reports zero requirements for these buffers, upper-layer networking code calculates packet sizes based on insufficient assumptions about available memory layout. This miscalculation leads directly to skb headroom underflows where the pointer arithmetic attempts to access memory before the start of the allocated buffer region.
The consequences of this memory mismanagement are severe and can lead to system instability or security compromises. In scenarios where dev_hard_header() or ipvlan_hard_header() attempts to prepend header data, the lack of reserved space forces reallocation overhead which degrades performance significantly under high load. More critically, if the kernel does not detect the insufficient buffer size before writing to it, it can result in slab-use-after-free crashes detected by Kernel Address Sanitizer (KASAN). These memory corruption events represent a potential avenue for denial-of-service attacks and could theoretically be exploited for arbitrary code execution if an attacker can control packet structures sent through these interfaces.
From a vulnerability classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input in C/C++ as it involves writing data into a buffer that may not have sufficient allocated space due to incorrect size calculations. It also relates to CWE-682 Incorrect Calculation which describes the failure to properly compute resource requirements leading to memory corruption. In terms of attack vectors, this falls under ATT&CK technique T1499 Endpoint Denial of Service via application layer exploits or system instability caused by improper input handling in network stack components.
The resolution involves two primary technical corrections within the kernel source code. First, during ipvlan_init(), the implementation now explicitly inherits both needed_headroom and needed_tailroom from the phy_dev, ensuring that the IPvLAN device accurately reflects the buffer requirements of its underlying hardware or virtual interface. Second, a dynamic propagation mechanism is added via ipvlan_device_event() to handle NETDEV_FEAT_CHANGE events. This ensures that if the characteristics of the lower device change at runtime, such as enabling MACsec offloading or changing tunnel parameters, the attached IPvLAN devices are immediately updated with the new buffer requirements rather than relying on static initialization values.
To mitigate this vulnerability in environments where kernel updates may be delayed, administrators should monitor for unusual network performance degradation or system crashes related to packet processing through IPvLAN interfaces. Disabling complex lower-layer features that require significant header overhead, such as MACsec encryption or specific tunneling protocols, can reduce the likelihood of triggering the buffer underflow condition until a patched kernel version is deployed. Regularly updating the Linux kernel to include this fix is essential for maintaining network stack integrity and preventing potential denial-of-service conditions arising from memory corruption in high-throughput networking scenarios.