CVE-2026-74476

A flaw was found in the veth component of the Linux kernel. This vulnerability occurs when a specially crafted network packet, known as a frag_list skb (socket buffer), is processed by the veth driver. An attacker could potentially send such a packet, causing the system to misinterpret fragment metadata. This misinterpretation can lead to a memory corruption issue, ultimately resulting in a system crash and a Denial of Service (DoS).

This vulnerability is rated as an Important severity flaw because an attacker capable of sending network packets to an affected interface can trigger memory corruption leading to an immediate kernel crash and denial of service. In typical Red Hat Enterprise Linux environments, virtual ethernet devices are primarily utilized for containerized network traffic, and exposure is limited to configurations where eXpress Data Path (XDP) or AF_XDP programs are actively attached to these interfaces. Systems operating standard networking configurations without XDP enabled on virtual ethernet links do not process packets through the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the virtual ethernet driver from loading on systems where virtual interfaces and containers are not required:

1. Blacklist the veth kernel module:

echo "install veth /bin/true" > /etc/modprobe.d/disable-veth.conf

2. Unload the module if it is currently loaded:

modprobe -r veth

Caveats: Disabling the veth driver prevents the creation of virtual ethernet pairs, which will disrupt container runtimes (such as Podman or OpenShift) and any network namespaces relying on virtual ethernet devices. If the module is actively in use, it cannot be unloaded dynamically and a system reboot will be required for the change to take effect.