PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74705 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's UDP tunnel segmentation has been addressed. The issue arises from __skb_udp_tunnel_segment() retrieving the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid. To fix this, the UDP header is retrieved after the pull.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-10-16
Advisory published
2026-08-22
Advisory updated
2026-10-16

Who should care

Linux kernel maintainers, administrators, and users of Linux-based systems should assess exposure and apply patches or updates as needed. This includes verifying Linux kernel versions, assessing configurations, and applying fixes to prevent potential use-after-free vulnerabilities.

Why it matters

A use-after-free vulnerability in the Linux kernel's UDP tunnel segmentation has been addressed. Linux kernel versions are affected, and patches or updates should be applied to fix the issue.

  • Verify Linux kernel versions and configurations to determine exposure.
  • Apply patches or updates provided by the Linux kernel maintainers to fix the vulnerability.
  • Assess potential impact on network security and system stability.

Technical summary

The Linux kernel's UDP tunnel segmentation has a use-after-free vulnerability. __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. The fix involves getting the UDP header after the pull. This change ensures that the UDP header is accessed after the tunnel header is verified to be in the skb head, preventing a potential use-after-free. Linux kernel maintainers, administrators, and users of Linux-based systems should assess exposure and apply patches or updates as needed.

Defensive priority

Verify Linux kernel versions and assess exposure based on used versions and configurations.

Recommended defensive actions

  • Verify Linux kernel versions in use against the affected versions.
  • Assess exposure based on used Linux kernel configurations.
  • Apply patches or updates provided by the Linux kernel maintainers.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability and its fix. Linux kernel versions are affected, with specific commits referenced. To verify exposure, defenders should check Linux kernel versions in use against the affected versions and assess configurations. The fix involves getting the UDP header after the pull to avoid a potential use-after-free. Evidence limits suggest that affected scope and impact may vary based on specific Linux kernel configurations and versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74705 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74705

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74705 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74705

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • udp: fix potential use-after-free in tunnel segmentation

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74705.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.