CVE-2026-74478

A flaw was found in the Linux kernel. A remote attacker, by sending specially crafted packets over GRE or L2TPv3 transports, could trigger a use-after-free vulnerability. This occurs in the vector_mmsg_rx() function when a packet's overlay header fails verification, causing the system to attempt to free an already freed network buffer. This issue leads to a denial of service.

A MODERATE severity use-after-free flaw was found in the Linux kernel user-mode Linux (UML) vector transport driver. In vector_mmsg_rx(), when a received packet's overlay header fails verify_header() and the packet is discarded, the freed skb is left in skbuff_vector[] and the loop cursors are not advanced; the next iteration then reads and frees the already-freed skb, producing a refcount underflow/use-after-free in the receive path. A remote peer on a vector transport whose verify_header() can return negative (GRE or L2TPv3 on a cookie/session-id mismatch; raw/tap transports are not affected) can trigger this without authentication, resulting in a denial of service. All Red Hat Enterprise Linux (6, 7, 8, 9, 10) and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm streams are listed as NOTAFFECTED because the vulnerable code is not present in the shipped kernels. The Red Hat severity (moderate, CVSS:3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is significantly lower than the upstream CVEORG rating (critical, 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Red Hat's assessment reflects that the affected UML vector driver code is not present in shipped Red Hat kernel packages, limiting exposure for Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.