CVE-2026-74473

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation. An incorrect buffer length check in the route_shortcircuit() function, specifically when using pskb_may_pull(), can lead to reading beyond the allocated buffer length. This occurs when processing IP headers in non-linear network packet fragments. This vulnerability could potentially allow an attacker to access sensitive information or cause a denial of service.

VXLAN route_shortcircuit can read past the pulled linear portion of a non linear skb because it checked only the IP header size from skb data while skb data still points at the MAC header. As a result ip_hdr(skb) or ipv6_hdr(skb) can be dereferenced before the full network header is present in the linear buffer. A remote adjacent attacker may be able to trigger this through traffic that enters a VXLAN transmit path with route short circuit behavior and a suitable non linear packet layout. For the CVSS the PR:N is used because no account on the victim is required if the attacker can inject traffic into the relevant adjacent network path. The likely impact is denial of service or incorrect neighbor lookup behavior, with at most limited confidentiality or integrity impact from an out of bounds read. Public Internet exposure is usually not expected because VXLAN is normally used inside data center, overlay, or tenant networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.