CRITICAL Introduced in 4.6
udp TunnelSegment UAF
CVE-2026-74705
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. Get the UDP header after the pull to avoid a potential use-after-free.
02KernelScan AI Analysis
Risk summary
A use-after-free in the UDP tunnel segmentation path allows network traffic flowing through a configured UDP tunnel (such as VXLAN or GENEVE) to trigger a stale pointer dereference in kernel memory. Systems forwarding traffic through UDP tunnels — including container hosts and multi-tenant environments using VXLAN overlays — are at risk. Successful exploitation could lead to kernel memory disclosure, corruption, or a system crash.
Vulnerability analysis
When the kernel splits UDP tunnel traffic into smaller segments, it records the UDP header location before making sure all tunnel header data is held in the main packet buffer. If the kernel later rearranges that buffer to pull in the tunnel header, the recorded location may point to memory that has been freed. The stale pointer is then used when computing checksums, causing a use-after-free. The fix changes the order of operations so the UDP header is located only after the buffer is guaranteed to be stable. This path is reached whenever traffic passes through an already-configured UDP tunnel such as VXLAN or GENEVE and requires software segmentation; it can be triggered by remote forwarded traffic or by local traffic sent through the tunnel interface, with no special privileges required of the sender.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.6 | 5.15.216 | 19d89b13a436 |
| 6.6 | 4.6 | 6.6.152 | 1ae134c012e1 |
| 6.12 | 4.6 | 6.12.104 | 5161e67c561c |
| 6.18 | 4.6 | 6.18.45 | 64d322c28857 |
| 7.1 | 4.6 | 7.1.9 | 588d4a6795d9 |
| mainline | 4.6 | 7.2 | d0f86fb36eb2 |
| 5.10 | 4.6 | 5.10.265 | 6a733a38b983 |
| 6.1 | 4.6 | 6.1.183 | b3df61bb745e |
| cip/4.19 | 4.6 | 4.19.325-cip136 | 3ef6f9d1b969 |
| cip/4.19-rt | 4.6 | 4.19.325-cip136-rt50 | 3ef6f9d1b969 |
| cip/5.10 | 4.6 | 5.10.268-cip77 | 6a733a38b983 |
| cip/5.10-rt | 4.6 | 5.10.268-cip77-rt34 | 6a733a38b983 |
| cip/6.1 | 4.6 | 6.1.187-cip60 | b3df61bb745e |
| cip/6.12 | 4.6 | 6.12.104-cip30 | 5161e67c561c |