CVE-2026-74705

The vulnerability exists in the Linux kernel’s UDP tunnelling logic. The function __skb_udp_tunnel_segment extracts a UDP header before confirming that a preceding tunnel header resides at the start of the socket buffer. If the pull operation reallocates the buffer, the previously stored header pointer becomes invalid, resulting in a use‑after‑free condition. An attacker could corrupt kernel memory, which may lead to denial of service or arbitrary code execution if the memory corruption is exploited. The flaw is a kernel‑level memory corruption vulnerability.

The defect is present in the Linux kernel code base, impacting all builds that include the defective UDP tunnelling implementation. No specific kernel versions are listed in the CVE data, so any currently running Linux kernel that has not applied the patch may be vulnerable. The vulnerability is cataloged as affecting the Linux operating system as a whole.

The CVE record lists a CVSS score of 10 and an EPSS score of <1%, indicating a critical severity but very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. From the description, the vulnerability appears exploitable via crafted UDP packets that traverse a tunnel, implying a network‑based attack vector. While exploitation potential exists, the very low EPSS score and lack of publicly available reports suggest it may not have been widely abused yet. Administrators should treat it as a critical kernel flaw and apply remediation promptly.