{"apiVersion":"1.0","identifier":"CVE-2026-74476","description":"In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.","publishedAt":"2026-08-15T13:17:52","lastModifiedAt":"2026-08-23T13:16:44","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74476","cvssScore":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","epssProbability":0.00491,"riskScore":0.95,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74476","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74476","en":"https://www.redsauce.net/en/cves/CVE-2026-74476","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74476","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74476","de":"https://www.redsauce.net/de/cves/CVE-2026-74476","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74476","el":"https://www.redsauce.net/el/cves/CVE-2026-74476"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74476"}}