CVE-2026-74612

A flaw was found in the Linux kernel's veth component. A remote attacker could exploit incorrect packet buffer (skb) length accounting after an eXpress Data Path (XDP) fragment adjustment. This could lead to the disclosure of sensitive kernel memory information to userspace and corruption or truncation of network packet data, potentially resulting in a denial of service.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because it requires a specialized network configuration where an eXpress Data Path (XDP) program that alters multi-buffer packet fragments is attached to a virtual Ethernet (veth) interface. In standard containerized environments, attaching custom multi-buffer XDP programs to virtual interface pairs is not a default configuration and requires elevated administrative privileges. While improper socket buffer accounting can expose residual kernel memory or trigger kernel assertions, the high bar of prerequisites and specific execution path limit the exposure across typical enterprise deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.