CRITICAL Introduced in 2.6.23
macvlan Headroom OOB
CVE-2026-74743
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.9HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
02KernelScan AI Analysis
Risk summary
A local user who can obtain CAP_NET_ADMIN (e.g., via an unprivileged user namespace) can create a macvlan device on top of a lower device that requires extra buffer headroom or tailroom, then send packets to trigger out-of-bounds writes into kernel heap memory. This can crash the kernel or potentially be exploited for privilege escalation or container escape. Products that allow untrusted local code or container workloads are most at risk.
Vulnerability analysis
When a macvlan virtual network device is created on top of a lower device, it copies the lower device's basic header size but fails to inherit the extra buffer space the lower device needs for adding headers, trailers, or padding. As a result, when packets are sent through the macvlan, the network stack allocates buffers that are too small, and later operations that add headers or trailers write past the buffer boundaries into adjacent kernel memory. The fix makes macvlan copy the lower device's buffer space requirements when the virtual device is created and propagate any later updates when the underlying device changes. The bug is reachable by any local user who can create network devices—CAP_NET_ADMIN is sufficient, and an unprivileged user can obtain that capability inside a user namespace, making this exploitable from containers or untrusted local workloads.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.23 | 5.10.271 | c2ef3f134b06 |
| 5.15 | 2.6.23 | 5.15.222 | 7b0eb3e0f363 |
| 6.1 | 2.6.23 | 6.1.184 | 8cd90e850e43 |
| 6.6 | 2.6.23 | 6.6.153 | 28afc87bd8da |
| 6.12 | 2.6.23 | 6.12.105 | 8f6a05dbac05 |
| 6.18 | 2.6.23 | 6.18.46 | 96fa90b74385 |
| 7.1 | 2.6.23 | 7.1.10 | bc9a00fb78e3 |
| mainline | 2.6.23 | 7.2 | cef51860becd |
| cip/6.1 | 2.6.23 | 6.1.187-cip60 | 8cd90e850e43 |
| cip/6.12 | 2.6.23 | 6.12.108-cip31 | 8f6a05dbac05 |