CVE-2026-74684

A flaw was found in the Linux kernel's net: tap module. A NULL pointer dereference can occur in the tap_get_user_xdp() function when processing an XDP buffer with a GSO virtio-net header and a zero protocol. This can be triggered by a malicious guest in a virtualized environment, leading to a system crash and a Denial of Service (DoS).

A NULL-pointer dereference in the Linux tap/vhost XDP transmit path can occur because tap_get_user_xdp() parses the virtio net header before assigning skb dev. A guest or adjacent virtual network endpoint can trigger this when the vhost TX path passes an XDP buffer with a GSO virtio net header and protocol value zero, causing dev_parse_header_protocol() to dereference a NULL skb dev pointer and crash the host kernel. For the CVSS the PR:N is used for the paranoid score because no privileges on the vulnerable host are required, although practical triggering requires access to a guest or virtual network path using tap and vhost. The issue is not Internet remote and is better modeled as adjacent or guest-to-host reachable. Impact is denial of service via host kernel crash. No direct confidentiality or integrity impact is assigned because the observed primitive is a NULL pointer dereference rather than UAF, OOB access, or arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.