In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_sh…
CVE-2026-74473 · published 15 Aug 2026
How serious is it
- Severity: critical, CVSS score 9.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-74473?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 3.8
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use pskb_network_may_pull() in route_shortcircuit()
route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))
(or ipv6hdr), which checks if bytes are available starting from skb->data.
However, in vxlan_xmit(), skb->data points to the MAC header, so
skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)
only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of
IP header), leaving the rest of the IP header potentially un-pulled in non-linear
frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled
linear buffer length.
Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to
the length check to ensure the full network header is present in the linear buffer.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53
- git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb
- git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c
- git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd
- git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4
- git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4
- git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e
- git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7
Merged from NVD. Last updated 24 Oct 2026. All vulnerabilities · RSS · JSON