Linux Kernel CVE-2026-74478

Requires a User Mode Linux instance configured with the 'vector' network transport using either GRE or L2TPv3 encapsulation - raw and tap transports are NOT affected because their verify_header() never returns negative. The trigger is a received packet that fails header verification specifically via a GRE cookie mismatch or an L2TPv3 session-id mismatch, which routes execution through the vulnerable verify_header() < 0 continue path. Exploitation needs no authentication (any peer on the transport can send such a packet), but is limited by the non-default deployment: only UML hosts running vector GRE/L2TPv3 networking are exposed, and the memory corruption is scoped to the UML process, not a native host kernel. It does not affect standard bare-metal or VM Linux kernels that are not running User Mode Linux with these transports.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as an unauthenticated remote critical, but that headline overstates realistic exposure: the bug is reachable only in User Mode Linux instances configured with a GRE or L2TPv3 vector transport - a specialized, non-default deployment - and the corruption is confined to the UML process rather than a bare-metal host kernel. Corroborating signals point lower: EPSS is 0.20% (10th percentile), there is no KEV listing and no public exploit identified at time of analysis, so this is not evidence of active or widespread exploitation. That said, within an affected UML deployment the precondition is weak - a single malicious or spoofed peer on the GRE/L2TPv3 tunnel can drive the RX path with no authentication - so an operator actually running UML vector networking on those transports should patch promptly rather than deferring on the low EPSS alone. The vendor 'Information Disclosure' tag is inconsistent with the described impact (memory corruption / UAF, which is primarily a crash-or-code-execution class rather than a read primitive) and should be treated with caution. Note also a data conflict worth verifying: AV:N/PR:N assumes an exposed, untrusted transport peer, which is only true if the GRE/L2TPv3 endpoint faces untrusted networks.

An attacker who can send frames to a UML instance's GRE or L2TPv3 vector transport (e.g. a peer on the tunnel, or someone able to spoof into it) sends a packet whose overlay header carries a mismatched GRE cookie or L2TPv3 session id. verify_header() returns negative, the skb is freed but its slot is not cleared, and the next RX iteration frees the same buffer again, corrupting kernel memory in the UML process - leading to a crash or potentially further memory-corruption exploitation. No public exploit is identified at time of analysis and no authentication is required on the affected transports.