CVE-2026-74684
Description
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
How to fix
- Linux Linux1d022885f3e6e0e238815391a4afaf3a4fb0a442, 61dd022c55c7307ec119e5672cb141cccbecf3b1, 15583b07fd691a844fbf7b3ad612cdc9e9a657c0, 8b444b126cd8e4473e652f529753ed4dd1360a9c, 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 3874892dd27d5387aa9a06f58d9060f18f351d24, 4.15, 4.20, 5.5, 5.11, 5.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 1d022885f3e6e0e238815391a4afaf3a4fb0a442, 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 61dd022c55c7307ec119e5672cb141cccbecf3b1, 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 15583b07fd691a844fbf7b3ad612cdc9e9a657c0, 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 8b444b126cd8e4473e652f529753ed4dd1360a9c, 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 924a9bc362a5223cd448ca08c3dde21235adc310 ≤ v < 3874892dd27d5387aa9a06f58d9060f18f351d24, ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d, 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3, ca278267d6cd9544645731732455b6b20cb0e895, faa3baa2828c5e1c4374f3e60041f75c64f5fcb6, 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748, 4.14.226 ≤ v < 4.15, 4.19.181 ≤ v < 4.20, 5.4.106 ≤ v < 5.5, 5.10.24 ≤ v < 5.11, 5.11.7 ≤ v < 5.12, 5.12 | 1d022885f3e6e0e238815391a4afaf3a4fb0a442, 61dd022c55c7307ec119e5672cb141cccbecf3b1, 15583b07fd691a844fbf7b3ad612cdc9e9a657c0, 8b444b126cd8e4473e652f529753ed4dd1360a9c, 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 3874892dd27d5387aa9a06f58d9060f18f351d24, 4.15, 4.20, 5.5, 5.11, 5.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.