Look up another CVE · open CVE-2026-74744 in the interactive tracker
CVE-2026-74744
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74744 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ipvlan/ipvlan_main.c
- What this is
- NETWORKING DRIVERSMAINTAINERS section matched on drivers/net/ · netdev@vger.kernel.org · Maintained
- Kernel module
- ipvlan
Check it on the machine
grep -wE 'CONFIG_IPVLAN|CONFIG_IPVTAP' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ipvlanPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_IPVLAN, CONFIG_IPVTAP
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.19 | 6.1.184 | af602c4d0ee5 |
| 3.19 | 6.6.153 | f3c17ff65f54 |
| 3.19 | 6.12.105 | c0fbe31f6b20 |
| 3.19 | 6.18.46 | 5f33188457bb |
| 3.19 | 7.1.10 | 5c2ca77212eb |
| 3.19 | 7.2 | e16e960d55a4 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- On hosts where admins deployed ipvlan over phy_dev with non-zero headroom (WireGuard/IPsec/macsec/tunnels/veth-XDP), remote packets that trigger egress through the ipvlan netdev (TCP/UDP/ICMP responses, forwarded traffic) reach ipvlan_hard_header/dev_hard_header without local syscalls.
- AC:LAttack complexity, low
- Once the stacked netdev exists, the attacker controls packet sizes and connection patterns to deterministically undersize skb headroom/tailroom; syzbot reproduced KASAN slab-UAF without races or uncontrollable memory layout.
- PR:NPrivileges required, none
- Remote exploitation on pre-deployed ipvlan-over-encrypted/tunneled container or VPN hosts requires no credentials—only network reachability to services using that netdev; CAP_NET_ADMIN is only needed for the alternate local user-namespace setup path.
- UI:NUser interaction, none
- No victim interaction is required; the attacker either sends crafted network traffic to trigger kernel TX through ipvlan or self-configures the netdev stack via rtnetlink inside a user namespace.
- S:UScope, unchanged
- Impact is kernel slab skb/net_device memory corruption and local privilege escalation within the same kernel security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.
- C:HConfidentiality impact, high
- Insufficient LL_RESERVED_SPACE causes pskb_expand_head to free still-referenced skb data and dev_hard_header skb_push to access memory outside the buffer; the fix cites KASAN slab-use-after-free, enabling arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- Slab UAF and skb headroom underflow during header prepend give heap-grooming and controlled overwrite primitives on attacker-influenced TX paths, suitable for kernel control-flow hijacking and code execution.
- A:HAvailability impact, high
- Undersized headroom triggers skb_under_panic BUG and KASAN-reported slab-use-after-free oops/panic from softirq/TX paths; remote or local attackers can retrigger repeatedly for reliable kernel denial of service.