What is the CVSS score of CVE-2026-74476?

CVE-2026-74476 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74476?

A critical denial-of-service vulnerability in the Linux kernel's veth driver (CVE-2026-74476) can crash systems running XDP programs with AF_XDP sockets in copy mode bound to veth interfaces.. A patch is available.

How to fix or mitigate CVE-2026-74476?

Within 24 hours, audit your Linux infrastructure to identify systems running XDP programs with AF_XDP sockets in copy mode on veth interfaces by reviewing kernel configuration and application architecture documentation. Within 7 days, apply the available vendor patch to any confirmed affected systems during your standard maintenance windows. Within 30 days, complete patch deployment verification and update your asset inventory to flag systems with this configuration for future vulnerability management.

Linux Kernel CVE-2026-74476

EUVD-2026-59669 CRITICAL

2026-08-15 Linux

GHSA-p72r-vmh2-4xj6

Denial Of Service Linux

9.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

5.9 MEDIUM

Crash is a denial of service (A:H, C:N/I:N); remote packet trigger (AV:N/PR:N) but needs AF_XDP-copy-mode-on-veth config plus a specific frag_list skb shape, so AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:41 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.1 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.

AnalysisAI

Denial-of-service (kernel crash) in the Linux kernel's veth driver affects hosts running an XDP program with AF_XDP sockets in copy mode bound to a virtual ethernet interface. When a frag_list skb (data_len set, nr_frags zero) reaches veth_convert_skb_to_xdp_buff(), the driver advertises XDP fragment metadata for a non-existent frags[] array, causing __xsk_rcv() to walk an empty fragment and crash inside memcpy(). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach XDP-enabled veth interface

Delivery

Induce frag_list skb (data_len set, nr_frags=0)

Exploit

veth advertises bogus XDP frags metadata

Execution

AF_XDP copy mode walks empty fragment

Persist

memcpy() dereferences invalid entry

Impact

Kernel panic / host denial of service

Access

Reach XDP-enabled veth interface

Delivery

Induce frag_list skb (data_len set, nr_frags=0)

Exploit

veth advertises bogus XDP frags metadata

Execution

AF_XDP copy mode walks empty fragment

Persist

memcpy() dereferences invalid entry

Impact

Kernel panic / host denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires a specific, non-default deployment: the host must be running an XDP program with an AF_XDP (XSK) socket operating in copy mode attached to a veth interface, and a frag_list skb (an skb with data_len set but nr_frags equal to zero) must be delivered into that veth XDP path - that exact skb shape and configuration IS the precondition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, 9.1) overstates real-world risk and is internally inconsistent with the evidence: the description and the 'Denial Of Service' tag describe a kernel crash in memcpy(), which is an availability event, yet the vector asserts C:H/A:H and no availability-only impact - the confidentiality-high rating is not supported by the described behavior and should be verified with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An operator runs a container-networking or high-performance packet-processing host that attaches an XDP program with an AF_XDP socket in copy mode to a veth interface. An attacker (or a fault-inducing traffic pattern) causes a frag_list-shaped skb - for example via GRO, tunnelling, or fragmented forwarding - to traverse that veth; XDP is handed fabricated fragment metadata, __xsk_rcv() walks the empty fragment entry, and the kernel panics in memcpy(), taking the host down. …
Remediation	Vendor-released patch: upgrade to a fixed Linux kernel - 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later within each stable series), which incorporate the stable commits at https://git.kernel.org/stable/c/5c1c15c540fc45820ce3033c319151ec891bc10a and the sibling commits b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb, f9c1fff857e93be709c8b52ed1a643f37bd82c66, and d0d6415963040c401e7a7e4e482a698ba52448cb; consume the corresponding build from your distribution's kernel stream. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit your Linux infrastructure to identify systems running XDP programs with AF_XDP sockets in copy mode on veth interfaces by reviewing kernel configuration and application architecture documentation. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74476 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74476

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code