CVE-2026-74684net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
- 7.1HighCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
Timeline
ID reserved
By Linux
- 7 days later
· 7 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 1d022885f3e6e0e238815391a4afaf3a4fb0a442
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 61dd022c55c7307ec119e5672cb141cccbecf3b1
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 15583b07fd691a844fbf7b3ad612cdc9e9a657c0
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 8b444b126cd8e4473e652f529753ed4dd1360a9c
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b
- affected 924a9bc362a5223cd448ca08c3dde21235adc310 – < 3874892dd27d5387aa9a06f58d9060f18f351d24
- affected ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d
- affected 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3
- affected ca278267d6cd9544645731732455b6b20cb0e895
- affected faa3baa2828c5e1c4374f3e60041f75c64f5fcb6
- affected 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748
- affected 4.14.226 – < 4.15
- affected 4.19.181 – < 4.20
- affected 5.4.106 – < 5.5
- affected 5.10.24 – < 5.11
- affected 5.11.7 – < 5.12
- affected 5.12
- unaffected < 5.12
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.105 – ≤ 6.12.*
- unaffected 6.18.45 – ≤ 6.18.*
- unaffected 7.1.9 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/1d022885f3e6e0e238815391a4afaf3a4fb0a442 (opens in a new tab)
- https://git.kernel.org/stable/c/61dd022c55c7307ec119e5672cb141cccbecf3b1 (opens in a new tab)
- https://git.kernel.org/stable/c/15583b07fd691a844fbf7b3ad612cdc9e9a657c0 (opens in a new tab)
- https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c (opens in a new tab)
- https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b (opens in a new tab)
- https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-64371 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-74684)Record last updated .