CRITICAL Introduced in 3.19
ipvlan Headroom UAF
CVE-2026-74744
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
02KernelScan AI Analysis
Risk summary
An unprivileged local user who can create and configure ipvlan devices (via user namespaces or CAP_NET_ADMIN) can trigger a use-after-free in the kernel's network stack. This can lead to kernel memory corruption, information disclosure, or denial of service.
Vulnerability analysis
When an ipvlan virtual device is created on top of a physical or lower device that requires extra packet headroom or tailroom (such as devices using macsec, ipsec, wireguard, tunnels, or veth with rx headroom), the ipvlan driver fails to inherit the needed headroom and tailroom values from the underlying device. As a result, the kernel's network stack underestimates the buffer space required when building packets through the ipvlan device. When a header is prepended or trailer data is appended, the socket buffer (skb) can underflow its headroom or overflow its tailroom, leading to a slab use-after-free detected by KASAN. The fix ensures ipvlan devices inherit the needed_headroom and needed_tailroom from their parent device at initialization time and whenever the parent's features change. This vulnerability is reachable locally by any user who can create network namespaces and configure ipvlan devices, which is possible with CAP_NET_ADMIN obtainable in a user namespace on most Linux distributions.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.19 | 6.1.184 | af602c4d0ee5 |
| 6.12 | 3.19 | 6.12.105 | c0fbe31f6b20 |
| 6.18 | 3.19 | 6.18.46 | 5f33188457bb |
| 7.1 | 3.19 | 7.1.10 | 5c2ca77212eb |
| mainline | 3.19 | 7.2 | e16e960d55a4 |
| 6.6 | 3.19 | 6.6.153 | f3c17ff65f54 |
| cip/6.1 | 3.19 | 6.1.187-cip60 | af602c4d0ee5 |
| cip/6.12 | 3.19 | 6.12.108-cip31 | c0fbe31f6b20 |