CVE-2026-74474

A flaw was found in the Linux kernel's vxlan module. This vulnerability arises from the incorrect handling of network packet headers during data transmission. Specifically, certain functions within the vxlan module fail to properly account for the initial part of the network packet, known as the Media Access Control (MAC) header. This oversight can lead to fragmented network header information, potentially causing unexpected network behavior or data processing errors.

VXLAN transmit path code used pskb_may_pull() to validate ARP, IPv6/ND, and IP/IPv6 MDB headers even though skb data still points at the MAC header on this path. This can leave part of the network header in non-linear skb fragments while later code reads arp_hdr(), ipv6_hdr(), or ip_hdr() as if the header were fully linear. A reachable attacker may be able to trigger an invalid header read or crash by causing specially shaped traffic to be transmitted through a VXLAN device with affected proxy or MDB handling enabled. For the CVSS the PR:N value is used for the paranoid score because a network adjacent sender may not need an account on the target when traffic can enter a bridge or overlay path that transmits through VXLAN. The issue is not a general Internet remote bug in typical deployments because VXLAN is usually used inside data center, tenant, or trusted overlay networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.