CVE-2026-74473 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, vxlan users, Linux distribution maintainers, and security teams responsible for patching and vulnerability management should be aware of this vulnerability. They should review and apply patches, monitor network traffic, and ensure that the Linux kernel is updated with the latest security patches to prevent potential exploitation attempts.

Technical summary

The Linux kernel's vxlan implementation has a vulnerability due to the incorrect use of pskb_may_pull in route_shortcircuit. This can cause subsequent dereferences to read beyond the pulled linear buffer length. The fix is to use pskb_network_may_pull, ensuring the full network header is present in the linear buffer. This change prevents potential buffer overflows and ensures the security of network communications.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated with the latest security patches
• Monitor network traffic for potential exploitation attempts
• Perform a thorough review of affected systems and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is in the Linux kernel's vxlan implementation. The issue arises from the incorrect use of pskb_may_pull in route_shortcircuit, which can lead to reading beyond the pulled linear buffer length. The fix involves using pskb_network_may_pull to ensure the full network header is present in the linear buffer. Evidence is limited to CVE and NVD details. Defenders should verify affected systems, review vendor advisories, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.