{"id":"CVE-2026-74701","revision":"b8c54c97b0fb43ff9d2e31a28d335470","records":[{"revision":"b8c54c97b0fb43ff9d2e31a28d335470","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74701","aliases":[],"title":"net/openvswitch: check Ethernet header length in key_extract()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/openvswitch: check Ethernet header length in key_extract()\n\nWhen a packet arrives on an ARPHRD_NONE device (e.g. TUN),\novs_flow_key_extract() trusts the user-provided skb->protocol field: if\nit is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and\nkey_extract() is called without ensuring the skb has ETH_HLEN (14) bytes\nof linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes\nfor MAC addresses and parse_ethertype() pulls 2 more, either of which\ntriggers a kernel BUG in __skb_pull() when the linear area is too small.\n\n  kernel BUG at include/linux/skbuff.h:2848!\n  RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\n  ovs_flow_key_extract+0x419/0xa70\n  ovs_vport_receive+0x222/0x390\n  netdev_frame_hook+0x3e0/0x630\n  tun_get_user+0x2d0c/0x38e0\n\nFixed by calling check_header() in key_extract() before accessing the\nEthernet header.","state":0,"publishedAt":"2026-08-22T15:33:01.585+00:00","modifiedAt":"2026-10-16T19:16:10.294+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/openvswitch/flow.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"e85278afd4890dd190ba3c7a1b1a712b801c9fe1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"81f9b09f0ea3ba9ab966dd17e9f32625a14555e9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"831471718f6e19aed1a330b03b53190a90e06466\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"d8bea341b183190ce6c055ab0e64ab78eb9a7290\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"0b60b55652ba772b173dddc63f3851e1d2dd5927\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"a8139285c8925efe59af28a9169bb2fda91bff15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"9b8cfbb58b85bfa7a78fac47fdc77396cd01f699\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"217ac77a3c2524d999730b2a80b61fcc2d0f734a\",\n                            \"lessThan\": \"cf6f8b29befb92173659bcef6a441d274947bfae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/openvswitch/flow.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.152\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.104\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.45\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.9\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1","https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9","https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466","https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290","https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927","https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15","https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699","https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74701","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74701","identifiers":["CVE-2026-74701"]},"retained":false,"historicalAffected":[]}],"coverage":[]}