CVE-2026-74701 (GCVE-0-2026-74701)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-10-16 19:16
VLAI
EPSS
VEX
Title
net/openvswitch: check Ethernet header length in key_extract()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/openvswitch: check Ethernet header length in key_extract()
When a packet arrives on an ARPHRD_NONE device (e.g. TUN),
ovs_flow_key_extract() trusts the user-provided skb->protocol field: if
it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and
key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes
of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes
for MAC addresses and parse_ethertype() pulls 2 more, either of which
triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848!
RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933
ovs_flow_key_extract+0x419/0xa70
ovs_vport_receive+0x222/0x390
netdev_frame_hook+0x3e0/0x630
tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the
Ethernet header.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:14 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
217ac77a3c2524d999730b2a80b61fcc2d0f734a , < e85278afd4890dd190ba3c7a1b1a712b801c9fe1
(git)
Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < 81f9b09f0ea3ba9ab966dd17e9f32625a14555e9 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < 831471718f6e19aed1a330b03b53190a90e06466 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < d8bea341b183190ce6c055ab0e64ab78eb9a7290 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < 0b60b55652ba772b173dddc63f3851e1d2dd5927 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < a8139285c8925efe59af28a9169bb2fda91bff15 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < 9b8cfbb58b85bfa7a78fac47fdc77396cd01f699 (git) Affected: 217ac77a3c2524d999730b2a80b61fcc2d0f734a , < cf6f8b29befb92173659bcef6a441d274947bfae (git) |
guessed | |
| Linux | Linux |
Affected:
4.10
Unaffected: 0 , < 4.10 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74701",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:55.662820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:10.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e85278afd4890dd190ba3c7a1b1a712b801c9fe1",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "81f9b09f0ea3ba9ab966dd17e9f32625a14555e9",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "831471718f6e19aed1a330b03b53190a90e06466",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "d8bea341b183190ce6c055ab0e64ab78eb9a7290",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "0b60b55652ba772b173dddc63f3851e1d2dd5927",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "a8139285c8925efe59af28a9169bb2fda91bff15",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "9b8cfbb58b85bfa7a78fac47fdc77396cd01f699",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "cf6f8b29befb92173659bcef6a441d274947bfae",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/openvswitch: check Ethernet header length in key_extract()\n\nWhen a packet arrives on an ARPHRD_NONE device (e.g. TUN),\novs_flow_key_extract() trusts the user-provided skb-\u003eprotocol field: if\nit is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and\nkey_extract() is called without ensuring the skb has ETH_HLEN (14) bytes\nof linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes\nfor MAC addresses and parse_ethertype() pulls 2 more, either of which\ntriggers a kernel BUG in __skb_pull() when the linear area is too small.\n\n kernel BUG at include/linux/skbuff.h:2848!\n RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\n ovs_flow_key_extract+0x419/0xa70\n ovs_vport_receive+0x222/0x390\n netdev_frame_hook+0x3e0/0x630\n tun_get_user+0x2d0c/0x38e0\n\nFixed by calling check_header() in key_extract() before accessing the\nEthernet header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The crash is reached when a crafted skb is processed in ovs_flow_key_extract() via ovs_vport_receive(); the documented reproducer injects it through tun_get_user() (write to a TUN fd), and the alternate path is OVS_PACKET_CMD_EXECUTE netlink\u2014both require local syscall access, not remote packet delivery.\nAC:L - The attacker fully controls skb length, skb-\u003eprotocol (ETH_P_TEB), and linear versus fragmented layout; sending a sub-14-byte payload with ETH_P_TEB on an ARPHRD_NONE OVS port deterministically reaches key_extract() and triggers __skb_pull() BUG() without races or special heap layout.\nPR:L - Attaching an ARPHRD_NONE netdev to an OVS datapath and using OVS_PACKET_CMD_EXECUTE require CAP_NET_ADMIN (GENL_UNS_ADMIN_PERM, netnsok); CAP_NET_ADMIN is obtainable inside an unprivileged user+network namespace, and TUN injection likewise requires CAP_NET_ADMIN or a TUN fd granted by a privileged setup.\nUI:N - No victim interaction is required; once OVS bridges an ARPHRD_NONE port (e.g. TUN), the attacker triggers the bug by injecting a single malformed packet via write() or netlink without any other user action.\nS:U - Impact is a kernel BUG/panic in the same kernel security authority as the attacker; this is not a VM escape, IOMMU bypass, or cross-namespace privilege boundary crossing.\nC:H - Before the BUG, key_extract() calls ether_addr_copy() and parse_ethertype() on skb-\u003edata without validating ETH_HLEN, performing out-of-bounds reads of kernel skb buffer memory beyond the actual packet payload.\nI:H - Unchecked __skb_pull() on an undersized skb corrupts skb-\u003edata and skb-\u003elen metadata; this memory corruption of kernel packet state can be leveraged for further integrity violations beyond a simple controlled crash.\nA:H - The flaw triggers kernel BUG() at __skb_pull() in include/linux/skbuff.h, producing a kernel oops/panic and denying all system availability on affected hosts running Open vSwitch with ARPHRD_NONE ports."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:43.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1"
},
{
"url": "https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9"
},
{
"url": "https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466"
},
{
"url": "https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290"
},
{
"url": "https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927"
},
{
"url": "https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15"
},
{
"url": "https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699"
},
{
"url": "https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae"
}
],
"title": "net/openvswitch: check Ethernet header length in key_extract()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74701",
"datePublished": "2026-08-22T15:33:01.585Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-10-16T19:16:10.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74701",
"date": "2026-11-01",
"epss": "0.0013",
"percentile": "0.02586"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:01:50.000Z",
"cve": "CVE-2026-74701",
"id": "msrc_CVE-2026-74701",
"initial_release_date": "2026-08-24T01:05:59.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net/openvswitch: check Ethernet header length in key_extract()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74701.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e85278afd4890dd190ba3c7a1b1a712b801c9fe1",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "81f9b09f0ea3ba9ab966dd17e9f32625a14555e9",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "831471718f6e19aed1a330b03b53190a90e06466",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "d8bea341b183190ce6c055ab0e64ab78eb9a7290",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "0b60b55652ba772b173dddc63f3851e1d2dd5927",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "a8139285c8925efe59af28a9169bb2fda91bff15",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "9b8cfbb58b85bfa7a78fac47fdc77396cd01f699",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "cf6f8b29befb92173659bcef6a441d274947bfae",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/openvswitch: check Ethernet header length in key_extract()\n\nWhen a packet arrives on an ARPHRD_NONE device (e.g. TUN),\novs_flow_key_extract() trusts the user-provided skb-\u003eprotocol field: if\nit is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and\nkey_extract() is called without ensuring the skb has ETH_HLEN (14) bytes\nof linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes\nfor MAC addresses and parse_ethertype() pulls 2 more, either of which\ntriggers a kernel BUG in __skb_pull() when the linear area is too small.\n\n kernel BUG at include/linux/skbuff.h:2848!\n RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\n ovs_flow_key_extract+0x419/0xa70\n ovs_vport_receive+0x222/0x390\n netdev_frame_hook+0x3e0/0x630\n tun_get_user+0x2d0c/0x38e0\n\nFixed by calling check_header() in key_extract() before accessing the\nEthernet header."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/openvswitch: verificar la longitud de la cabecera Ethernet en key_extract()\n\nCuando un paquete llega a un dispositivo ARPHRD_NONE (p. ej. TUN), ovs_flow_key_extract() conf\u00eda en el campo skb -\u003e protocol proporcionado por el usuario: si es ETH_P_TEB, el paquete se clasifica como MAC_PROTO_ETHERNET y se llama a key_extract() sin asegurar que el skb tenga ETH_HLEN (14) bytes de datos lineales. key_extract() extrae incondicionalmente 2 * ETH_ALEN bytes para direcciones MAC y parse_ethertype() extrae 2 m\u00e1s, cualquiera de los cuales activa un BUG del kernel en __skb_pull() cuando el \u00e1rea lineal es demasiado peque\u00f1a.\n\nBUG del kernel en include/linux/skbuff.h:2848!\nRIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\novs_flow_key_extract+0x419/0xa70\novs_vport_receive+0x222/0x390\nnetdev_frame_hook+0x3e0/0x630\ntun_get_user+0x2d0c/0x38e0\n\nSolucionado llamando a check_header() en key_extract() antes de acceder a la cabecera Ethernet."
}
],
"id": "CVE-2026-74701",
"lastModified": "2026-10-16T20:17:52.970",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74701",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:55.662820Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-22T16:16:44.740",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-01T08:22:42+00:00",
"cve": "CVE-2026-74701",
"id": "CVE-2026-74701",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "276",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net/openvswitch: check Ethernet header length in key_extract()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74701.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74701",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:55.662820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:14:56.564Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e85278afd4890dd190ba3c7a1b1a712b801c9fe1",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "81f9b09f0ea3ba9ab966dd17e9f32625a14555e9",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "831471718f6e19aed1a330b03b53190a90e06466",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "d8bea341b183190ce6c055ab0e64ab78eb9a7290",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "0b60b55652ba772b173dddc63f3851e1d2dd5927",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "a8139285c8925efe59af28a9169bb2fda91bff15",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "9b8cfbb58b85bfa7a78fac47fdc77396cd01f699",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
},
{
"lessThan": "cf6f8b29befb92173659bcef6a441d274947bfae",
"status": "affected",
"version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/openvswitch: check Ethernet header length in key_extract()\n\nWhen a packet arrives on an ARPHRD_NONE device (e.g. TUN),\novs_flow_key_extract() trusts the user-provided skb-\u003eprotocol field: if\nit is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and\nkey_extract() is called without ensuring the skb has ETH_HLEN (14) bytes\nof linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes\nfor MAC addresses and parse_ethertype() pulls 2 more, either of which\ntriggers a kernel BUG in __skb_pull() when the linear area is too small.\n\n kernel BUG at include/linux/skbuff.h:2848!\n RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\n ovs_flow_key_extract+0x419/0xa70\n ovs_vport_receive+0x222/0x390\n netdev_frame_hook+0x3e0/0x630\n tun_get_user+0x2d0c/0x38e0\n\nFixed by calling check_header() in key_extract() before accessing the\nEthernet header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The crash is reached when a crafted skb is processed in ovs_flow_key_extract() via ovs_vport_receive(); the documented reproducer injects it through tun_get_user() (write to a TUN fd), and the alternate path is OVS_PACKET_CMD_EXECUTE netlink\u2014both require local syscall access, not remote packet delivery.\nAC:L - The attacker fully controls skb length, skb-\u003eprotocol (ETH_P_TEB), and linear versus fragmented layout; sending a sub-14-byte payload with ETH_P_TEB on an ARPHRD_NONE OVS port deterministically reaches key_extract() and triggers __skb_pull() BUG() without races or special heap layout.\nPR:L - Attaching an ARPHRD_NONE netdev to an OVS datapath and using OVS_PACKET_CMD_EXECUTE require CAP_NET_ADMIN (GENL_UNS_ADMIN_PERM, netnsok); CAP_NET_ADMIN is obtainable inside an unprivileged user+network namespace, and TUN injection likewise requires CAP_NET_ADMIN or a TUN fd granted by a privileged setup.\nUI:N - No victim interaction is required; once OVS bridges an ARPHRD_NONE port (e.g. TUN), the attacker triggers the bug by injecting a single malformed packet via write() or netlink without any other user action.\nS:U - Impact is a kernel BUG/panic in the same kernel security authority as the attacker; this is not a VM escape, IOMMU bypass, or cross-namespace privilege boundary crossing.\nC:H - Before the BUG, key_extract() calls ether_addr_copy() and parse_ethertype() on skb-\u003edata without validating ETH_HLEN, performing out-of-bounds reads of kernel skb buffer memory beyond the actual packet payload.\nI:H - Unchecked __skb_pull() on an undersized skb corrupts skb-\u003edata and skb-\u003elen metadata; this memory corruption of kernel packet state can be leveraged for further integrity violations beyond a simple controlled crash.\nA:H - The flaw triggers kernel BUG() at __skb_pull() in include/linux/skbuff.h, producing a kernel oops/panic and denying all system availability on affected hosts running Open vSwitch with ARPHRD_NONE ports."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:43.778Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1"
},
{
"url": "https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9"
},
{
"url": "https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466"
},
{
"url": "https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290"
},
{
"url": "https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927"
},
{
"url": "https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15"
},
{
"url": "https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699"
},
{
"url": "https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae"
}
],
"title": "net/openvswitch: check Ethernet header length in key_extract()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74701",
"datePublished": "2026-08-22T15:33:01.585Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-10-16T19:16:10.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.