Answer in brief
CVE-2026-74684 records a High severity (CVSS 7.1) vulnerability in net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=924a9bc362a5223cd448ca08c3dde21235adc310 <8b444b126cd8e4473e652f529753ed4dd1360a9c || >=924a9bc362a5223cd448ca08c3dde21235adc310 <164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b || >=924a9bc362a5223cd448ca08c3dde21235adc310 <3874892dd27d5387aa9a06f58d9060f18f351d24 || ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d || 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 || ca278267d6cd9544645731732455b6b20cb0e895 || faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 || 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 || >=4.14.226 <4.15 || >=4.19.181 <4.20 || >=5.4.106 <5.5 || >=5.10.24 <5.11 || >=5.11.7 <5.12 | 8b444b126cd8e4473e652f529753ed4dd1360a9c, 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 3874892dd27d5387aa9a06f58d9060f18f351d24, 4.15, 4.20, 5.5, 5.11, 5.12 |
| Linux/Linuxgeneric | 5.12 | Not reported |
| Linux/Linuxgeneric | >=924a9bc362a5223cd448ca08c3dde21235adc310 <15583b07fd691a844fbf7b3ad612cdc9e9a657c0 || >=924a9bc362a5223cd448ca08c3dde21235adc310 <8b444b126cd8e4473e652f529753ed4dd1360a9c || >=924a9bc362a5223cd448ca08c3dde21235adc310 <164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b || >=924a9bc362a5223cd448ca08c3dde21235adc310 <3874892dd27d5387aa9a06f58d9060f18f351d24 || ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d || 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 || ca278267d6cd9544645731732455b6b20cb0e895 || faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 || 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 || >=4.14.226 <4.15 || >=4.19.181 <4.20 || >=5.4.106 <5.5 || >=5.10.24 <5.11 || >=5.11.7 <5.12 | 15583b07fd691a844fbf7b3ad612cdc9e9a657c0, 8b444b126cd8e4473e652f529753ed4dd1360a9c, 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 3874892dd27d5387aa9a06f58d9060f18f351d24, 4.15, 4.20, 5.5, 5.11, 5.12 |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
Quoted source text, attributed separately from HOL analysis.