Critical Vulnerability: CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved:

net: fix skb length accounting after generic XDP frag adjustment

Generic XDP exposes non-linear skb fragments through an xdp_buff. If an

XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies

xdp_frags_size back to skb->data_len but leaves skb->len containing the

old fragment contribution.

After a fragment shrink, this makes skb_headlen() larger than the actual

linear area. In the reproduced UDP receive path, __skb_datagram_iter()

copied 1024 bytes past the actual linear tail to userspace, starting at

struct skb_shared_info. The copied bytes included the affected skb's

nr_frags, xdp_frags_size and a kernel pointer from

skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same

amount and truncated at the end.

Subtract the old data_len before replacing it and add the new data_len

afterwards, keeping skb->len and skb->data_len synchronized.

A 60000-byte UDP datagram on a veth pair with M

CVE-2026-74665 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.1/10

EPSS (Exploit Prediction): 0.2% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-74665 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.