CVE-2026-74743

A flaw was found in the Linux kernel's macvlan component. The macvlan component incorrectly initializes network packet buffer (skb) headroom and tailroom values, failing to inherit them from the underlying network device. This can occur when the underlying device requires additional space for headers or trailers, such as with macsec or IPsec. This oversight can lead to memory corruption, specifically KASAN slab-use-after-free crashes, potentially resulting in a denial of service.

Important impact is assigned to this flaw because the resulting packet buffer underflow can cause kernel slab memory corruption or system crashes, posing a severe risk to host availability and integrity. Exploitation requires configuring a macvlan interface layered over an underlying network device that reserves supplemental header or trailer capacity, such as IPsec, MACsec, or encapsulation tunnels. Standard Red Hat Enterprise Linux deployments do not configure this specific network topology by default, and establishing macvlan links generally necessitates administrative privileges or access to unprivileged user namespaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems that do not require MACVLAN interfaces, prevent the macvlan kernel module from loading:

1. Create a configuration file in /etc/modprobe.d to disable module loading:

# echo "install macvlan /bin/true" > /etc/modprobe.d/macvlan.conf

2. If the module is currently loaded and no active interfaces depend on it, unload it:

# modprobe -r macvlan

Warning: Disabling this module prevents the creation and operation of MACVLAN virtual network devices, which will impact container or virtual machine networking configurations that rely on this driver. If the module is actively in use by running services or containers, it cannot be safely unloaded at runtime and a system restart will be required for the configuration to take effect.