HIGH
tap XdpPath Deref
CVE-2026-74684
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
02KernelScan AI Analysis
Risk summary
A guest virtual machine can crash the host kernel by sending a crafted packet through a virtio-net device backed by a tap device. The crash occurs because the tap driver's XDP transmit path parses a virtio-net header before assigning the network device pointer to the packet buffer, leading to a NULL pointer dereference. Any host running KVM/QEMU VMs with vhost-net and tap networking is affected.
Vulnerability analysis
In the tap driver's XDP transmit path, the virtio-net header is parsed before the packet's device pointer is set. When a GSO packet with a zeroed protocol field is processed, the header parsing routine calls a function that dereferences the still-NULL device pointer, causing a kernel panic. The same bug was previously fixed in the non-XDP transmit path but not in the XDP path. The fix moves the device lookup and assignment before the header parsing, matching the ordering already used in the non-XDP path. This vulnerability is reachable by a guest VM sending crafted packets through a virtio-net device backed by a tap device on the host, requiring no privileges on the host itself—only that the host runs VMs with vhost-net and tap networking.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.14 | 4.14.226 | 4.15 | 15583b07fd69 |
| 4.19 | 4.19.181 | 4.20 | 8b444b126cd8 |
| 5.4 | 5.4.106 | 5.5 | 164c31ee252e |
| 5.10 | 5.10.24 | 5.11 | 3874892dd27d |
| 5.11 | 5.11.7 | 5.12 | — |
| 6.12 | — | 6.12.105 | — |
| 6.18 | — | 6.18.45 | — |
| 7.1 | — | 7.1.9 | — |
| mainline | — | 7.2 | — |
| cip/6.12 | — | 6.12.108-cip31 | 15583b07fd69 |