What is the CVSS score of CVE-2026-74474?

CVE-2026-74474 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74474?

Linux kernel VXLAN driver contains a header validation defect that can disclose network metadata during packet transmission on virtualized overlay networks.. A patch is available.

How to fix or mitigate CVE-2026-74474?

Within 24 hours, identify and catalog systems deploying VXLAN overlays, prioritizing assets handling sensitive network traffic. Within 7 days, stage and test the vendor kernel patch in non-production VXLAN environments to confirm operational compatibility. Deploy patches to production infrastructure within 30 days using validated change procedures.

Linux Kernel CVE-2026-74474

EUVD-2026-59667 CRITICAL

2026-08-15 Linux

GHSA-59jj-4qq4-v9f9

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.2 MEDIUM

Reaching the VXLAN tx path needs overlay/L2 adjacency (AV:A) and a rare skb-fragment-boundary layout (AC:H); impact is a bounded stale-memory read (C:L) with possible misparse/instability (A:L), not the source's C:H/I:H/A:H.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:40 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use pskb_network_may_pull() for transmit path header pulls

In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys).

However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags.

Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

AnalysisAI

Improper transmit-path header validation in the Linux kernel VXLAN driver (functions vxlan_xmit, arp_reduce, and vxlan_mdb_entry_skb_get) can cause the driver to read network-layer header bytes (ARP, IPv6/ND, IP/IPv6 MDB keys) that reside in non-linear skb fragments. The root cause is the use of pskb_may_pull(), which measures length from skb->data - which on transmit points at the MAC header - instead of pskb_network_may_pull(), which accounts for the ETH_HLEN (14-byte) network offset; the result is that part of the network header may remain unpulled in paged fragments and be parsed from stale linear-buffer memory, an information-disclosure/misparse condition. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain L2/overlay adjacency to VXLAN host

Delivery

Inject crafted ARP/ND/MDB frame

Exploit

Header straddles skb fragment boundary

Execution

Driver reads unpulled header from stale memory

Impact

Leak adjacent kernel bytes or misparse header

Access

Gain L2/overlay adjacency to VXLAN host

Delivery

Inject crafted ARP/ND/MDB frame

Exploit

Header straddles skb fragment boundary

Execution

Driver reads unpulled header from stale memory

Impact

Leak adjacent kernel bytes or misparse header

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target host to have a VXLAN overlay interface configured and actively forwarding - this is not present in default Linux installs and is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals in this record are strongly self-consistent and point to LOW real-world urgency despite the headline score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with the ability to inject ARP, IPv6 neighbor-discovery, or multicast (MDB) traffic onto a VXLAN-backed segment sends frames crafted so their network header lands at the linear/non-linear skb boundary during transmit processing. The VXLAN driver parses the partially-present header from stale linear-buffer bytes, potentially disclosing adjacent kernel memory into forwarding decisions or emitted packets, or making an incorrect routing/replication decision. …
Remediation	Vendor-released patch: upgrade to Linux 6.18.44 or 7.1.8 (or 7.2-rc6 for the mainline release-candidate branch), or apply your distribution's backport of stable commits 94dee751, 7076a34b, or b9553558 from git.kernel.org (e.g. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and catalog systems deploying VXLAN overlays, prioritizing assets handling sensitive network traffic. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74474 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74474

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code