CVE-2026-74701

net/openvswitch: check Ethernet header length in key_extract()

Published Aug 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/openvswitch: check Ethernet header length in key_extract()

When a packet arrives on an ARPHRD_NONE device (e.g. TUN),
ovs_flow_key_extract() trusts the user-provided skb->protocol field: if
it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and
key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes
of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes
for MAC addresses and parse_ethertype() pulls 2 more, either of which
triggers a kernel BUG in __skb_pull() when the linear area is too small.

kernel BUG at include/linux/skbuff.h:2848!
RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933
ovs_flow_key_extract+0x419/0xa70
ovs_vport_receive+0x222/0x390
netdev_frame_hook+0x3e0/0x630
tun_get_user+0x2d0c/0x38e0

Fixed by calling check_header() in key_extract() before accessing the
Ethernet header.

Analysis

Technical impact

The Linux kernel allowed a packet received on an ARPHRD_NONE device, such as a TUN interface, to be processed by key_extract() without verifying that the packet contained at least the expected 14 bytes of Ethernet header data. This omission meant that when the skb->protocol field was set to ETH_P_TEB, the kernel attempted to pull 2×ETH_ALEN bytes for MAC addresses and an additional 2 bytes for the ethertype, which triggered a BUG in __skb_pull() and caused a kernel crash. The result is a denial of service, potentially affecting system availability when a misconstructed packet is received. The likely attack vector involves local or privileged access to inject malformed packets into an ARPHRD_NONE device.

Affected Systems

All Linux kernel builds that include the openvswitch network subsystem and support ARPHRD_NONE devices are impacted, including any release that has not incorporated the fix that adds a check_header() call before accessing the Ethernet header. The issue manifests on systems that create or use TUN/TAP interfaces or other devices that expose the ARPHRD_NONE type.

Risk and Exploitability

The CVSS score of 7.8 marks this vulnerability as high severity. The likely attack vector involves local or privileged access to inject malformed packets into an ARPHRD_NONE device, after which a crafted packet can trigger a kernel BUG, causing a system crash and resulting in denial of service. The EPSS score is present but below 1%, indicating a very low probability of exploitation in the wild. It is not listed in CISA KEV, so no known widespread exploitation cases exist. Systems exposing TUN/TAP interfaces to untrusted users remain at elevated risk until the bug is addressed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< e85278afd4890dd190ba3c7a1b1a712b801c9fe1
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< 81f9b09f0ea3ba9ab966dd17e9f32625a14555e9
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< 831471718f6e19aed1a330b03b53190a90e06466
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< d8bea341b183190ce6c055ab0e64ab78eb9a7290
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< 0b60b55652ba772b173dddc63f3851e1d2dd5927
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< a8139285c8925efe59af28a9169bb2fda91bff15
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< 9b8cfbb58b85bfa7a78fac47fdc77396cd01f699
`217ac77a3c2524d999730b2a80b61fcc2d0f734a`	affected	< cf6f8b29befb92173659bcef6a441d274947bfae

Linux

affected

Version	Status	Constraints
`4.10`	affected	—
`0`	unaffected	< 4.10
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,e85278afd4890dd190ba3c7a1b1a712b801c9fe1)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,81f9b09f0ea3ba9ab966dd17e9f32625a14555e9)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,831471718f6e19aed1a330b03b53190a90e06466)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,d8bea341b183190ce6c055ab0e64ab78eb9a7290)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,0b60b55652ba772b173dddc63f3851e1d2dd5927)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,a8139285c8925efe59af28a9169bb2fda91bff15)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,9b8cfbb58b85bfa7a78fac47fdc77396cd01f699)`	affected	code_commit	—
`[217ac77a3c2524d999730b2a80b61fcc2d0f734a,cf6f8b29befb92173659bcef6a441d274947bfae)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.10`	affected	generic	—
`[0,4.10)`	unaffected	generic	—
`[5.10.265,6.0.0]`	unaffected	semver	—
`[5.15.216,5.16.0]`	unaffected	semver	—
`[6.1.183,6.2.0]`	unaffected	semver	—
`[6.6.152,6.7.0]`	unaffected	semver	—
`[6.12.104,6.13.0]`	unaffected	semver	—
`[6.18.45,6.19.0]`	unaffected	semver	—
`[7.1.9,7.2.0]`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that implements the check_header() call in key_extract()
Restrict the creation and use of ARPHRD_NONE interfaces such as TUN to privileged users until the patch is deployed
Disable unused TUN/TAP interfaces or carefully audit their usage to reduce attack surface

Generated by OpenCVE AI on August 25, 2026 at 13:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.130% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927
https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9
https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466
https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699
https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15
https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae
https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290
https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1
https://lore.kernel.org/linux-cve-announce/2026082235-CVE-2026-74701-282b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74701
https://www.cve.org/CVERecord?id=CVE-2026-74701

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026082235-CVE-2026-74701-282b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74701 https://www.cve.org/CVERecord?id=CVE-2026-74701
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 11:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-788

Aug 25, 2026 9:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-20

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 7:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-20

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0 Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
Title		net/openvswitch: check Ethernet header length in key_extract()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927 https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9 https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466 https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699 https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15 https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290 https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1