What is the CVSS score of CVE-2026-74473?

CVE-2026-74473 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74473?

CVE-2026-74473 is a memory disclosure vulnerability in the Linux kernel VXLAN driver affecting data centers and cloud networks using virtual overlay networking with proxy mode enabled.. A patch is available.

How to fix or mitigate CVE-2026-74473?

Within 24 hours, inventory all Linux hosts running VXLAN with proxy mode enabled and determine which systems are running vulnerable kernel versions per the vendor advisory. Within 7 days, apply the vendor-released kernel patch that corrects the buffer validation in the VXLAN driver across all affected systems, starting with production infrastructure components handling sensitive data. Within 30 days, validate patch deployment using configuration management or security scanning tools, document your remediation timeline for audit purposes, and confirm no systems remain running vulnerable kernel versions.

Linux Kernel CVE-2026-74473

EUVD-2026-59666 CRITICAL

2026-08-15 Linux

GHSA-h9rh-wf2h-cr4c

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.8 MEDIUM

Reachable via network packets but needs non-default proxy config plus attacker-controlled non-linear skbs (AC:H); impact is a bounded OOB read causing info leak or crash, so C:L/A:L, no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:39 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() in route_shortcircuit()

route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data.

However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length.

Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.

AnalysisAI

Out-of-bounds read in the Linux kernel's VXLAN driver stems from route_shortcircuit() validating only 20 bytes from skb->data instead of accounting for the 14-byte MAC header offset, so ip_hdr()->daddr dereferences can read past the pulled linear buffer when packets have non-linear fragments. The flaw affects hosts running VXLAN tunneling with proxy mode, is tagged as an information-disclosure issue, and has no public exploit identified at time of analysis (EPSS 0.17%, 6th percentile). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach VXLAN-proxy host with traffic

Delivery

Send crafted non-linear encapsulated packet

Exploit

route_shortcircuit skips full header pull

Execution

ip_hdr(skb)->daddr reads past linear buffer

Impact

Leak adjacent kernel memory or crash

Access

Reach VXLAN-proxy host with traffic

Delivery

Send crafted non-linear encapsulated packet

Exploit

route_shortcircuit skips full header pull

Execution

ip_hdr(skb)->daddr reads past linear buffer

Impact

Leak adjacent kernel memory or crash

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target host to run a VXLAN interface with proxy mode enabled (VXLAN_F_PROXY / the 'proxy' option), because route_shortcircuit() is only reached on that code path during vxlan_xmit(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can inject traffic that a VXLAN-proxy-configured host will encapsulate crafts frames that arrive as non-linear (fragmented/paged) skbs where the IP header spans beyond the linear buffer; when route_shortcircuit() dereferences ip_hdr(skb)->daddr it reads adjacent kernel memory, potentially leaking data or crashing the host. No public proof-of-concept is identified at time of analysis, and reliable exploitation requires precise control over skb layout plus the non-default proxy configuration.
Remediation	Vendor-released patch: upgrade to a fixed stable kernel - 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later in each series), which replace pskb_may_pull() with pskb_network_may_pull() in route_shortcircuit(). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux hosts running VXLAN with proxy mode enabled and determine which systems are running vulnerable kernel versions per the vendor advisory. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74473 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74473

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code