CVE-2026-74478 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of systems using GRE or L2TPv3 transports, and security teams monitoring for potential use-after-free attacks. Additionally, operators of affected systems, platform administrators, and vulnerability management teams should be aware of the vulnerability and take necessary actions to mitigate it.

Technical summary

The Linux kernel's vector_mmsg_rx() function has a use-after-free vulnerability. When a packet's overlay header fails verification, the function frees the skb but does not clear the consumed slot, allowing the next iteration to read the freed skb and trigger a refcount underflow. This affects systems using GRE or L2TPv3 transports. The vulnerability can be triggered without authentication, making it a high-risk issue for affected systems.

Defensive priority

Linux kernel vulnerability in vector_mmsg_rx() function, allowing for use-after-free attacks; prioritize patching for systems using GRE or L2TPv3 transports.

Recommended defensive actions

• Apply patch to Linux kernel to fix use-after-free vulnerability in vector_mmsg_rx() function
• Review and update systems using GRE or L2TPv3 transports
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official CVE and NVD sources; vulnerability in Linux kernel vector_mmsg_rx() function; limited detail on affected systems and exploitation. Additional evidence notes: The vulnerability affects Linux kernel versions that have not been patched. GRE and L2TPv3 transports are impacted. Defenders should verify patch deployment and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.