Answer in brief
CVE-2026-74684 records a Unknown severity vulnerability in net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=924a9bc362a5223cd448ca08c3dde21235adc310 <8b444b126cd8e4473e652f529753ed4dd1360a9c || >=924a9bc362a5223cd448ca08c3dde21235adc310 <164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b || >=924a9bc362a5223cd448ca08c3dde21235adc310 <3874892dd27d5387aa9a06f58d9060f18f351d24 || ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d || 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 || ca278267d6cd9544645731732455b6b20cb0e895 || faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 || 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 || >=4.14.226 <4.15 || >=4.19.181 <4.20 || >=5.4.106 <5.5 || >=5.10.24 <5.11 || >=5.11.7 <5.12 | 8b444b126cd8e4473e652f529753ed4dd1360a9c, 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b, 3874892dd27d5387aa9a06f58d9060f18f351d24, 4.15, 4.20, 5.5, 5.11, 5.12 |
| Linux/Linuxgeneric | 5.12 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().
Quoted source text, attributed separately from HOL analysis.