Answer in brief
CVE-2026-74474 records a Unknown severity vulnerability in vxlan: use pskb_network_may_pull() for transmit path header pulls. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e4f67addf158f98f8197e08974966b18480dc751 <94dee751aad627b3645d424b5d0c736d394573e9 || >=e4f67addf158f98f8197e08974966b18480dc751 <7076a34b6e33315dc160b4612bfea1c597495585 || >=e4f67addf158f98f8197e08974966b18480dc751 <b9553558b48db54ac9273e6b98d7263ef5c1a329 | 94dee751aad627b3645d424b5d0c736d394573e9, 7076a34b6e33315dc160b4612bfea1c597495585, b9553558b48db54ac9273e6b98d7263ef5c1a329 |
| Linux/Linuxgeneric | 3.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-74474 records a Unknown severity vulnerability in vxlan: use pskb_network_may_pull() for transmit path header pulls. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e4f67addf158f98f8197e08974966b18480dc751 <94dee751aad627b3645d424b5d0c736d394573e9 || >=e4f67addf158f98f8197e08974966b18480dc751 <7076a34b6e33315dc160b4612bfea1c597495585 || >=e4f67addf158f98f8197e08974966b18480dc751 <b9553558b48db54ac9273e6b98d7263ef5c1a329 | 94dee751aad627b3645d424b5d0c736d394573e9, 7076a34b6e33315dc160b4612bfea1c597495585, b9553558b48db54ac9273e6b98d7263ef5c1a329 |
| Linux/Linuxgeneric | 3.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.
Quoted source text, attributed separately from HOL analysis.