CVE-2026-74701

A flaw was found in the Open vSwitch component of the Linux kernel. When a specially crafted packet with ETH_P_TEB protocol arrives on an ARPHRD_NONE device, the key_extract() function does not properly verify the Ethernet header length. This oversight allows a remote attacker to trigger a kernel bug, leading to a denial of service.

This vulnerability is rated as Moderate because it leads strictly to a kernel crash resulting in denial of service, without enabling privilege escalation or data confidentiality loss. Triggering the condition requires an Open vSwitch datapath attached to a point-to-point or tunnel interface (such as a TUN device) processing malformed frames with truncated Ethernet headers. Standard Red Hat Enterprise Linux configurations do not attach these non-Ethernet virtual devices to Open vSwitch bridges by default, limiting exploitation to specialized network architectures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.