CVE-2026-74478
Description
A flaw was found in the Linux kernel. A remote attacker, by sending specially crafted packets over GRE or L2TPv3 transports, could trigger a use-after-free vulnerability. This occurs in the vector_mmsg_rx() function when a packet's overlay header fails verification, causing the system to attempt to free an already freed network buffer. This issue leads to a denial of service.
Statement
A MODERATE severity use-after-free flaw was found in the Linux kernel user-mode Linux (UML) vector transport driver. In vector_mmsg_rx(), when a received packet's overlay header fails verify_header() and the packet is discarded, the freed skb is left in skbuff_vector[] and the loop cursors are not advanced; the next iteration then reads and frees the already-freed skb, producing a refcount underflow/use-after-free in the receive path. A remote peer on a vector transport whose verify_header() can return negative (GRE or L2TPv3 on a cookie/session-id mismatch; raw/tap transports are not affected) can trigger this without authentication, resulting in a denial of service. All Red Hat Enterprise Linux (6, 7, 8, 9, 10) and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm streams are listed as NOTAFFECTED because the vulnerable code is not present in the shipped kernels. The Red Hat severity (moderate, CVSS:3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is significantly lower than the upstream CVEORG rating (critical, 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Red Hat's assessment reflects that the affected UML vector driver code is not present in shipped Red Hat kernel packages, limiting exposure for Red Hat products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
