What is the CVSS score of CVE-2026-74744?

CVE-2026-74744 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Linux kernel are affected by CVE-2026-74744?

A critical memory corruption vulnerability in Linux kernel's ipvlan networking driver can cause system crashes through denial of service attacks.. A patch is available.

How to fix or mitigate CVE-2026-74744?

Within 24 hours, identify all Linux systems currently using ipvlan drivers and assess exposure in your infrastructure. Within 7 days, consult your Linux distribution vendor's security advisories for patched kernel versions, apply patches to test environments, and validate kernel functionality. Within 30 days, deploy patched kernel versions to all production systems running ipvlan and perform system validation testing to confirm resolution.

Linux kernel CVE-2026-74744

EUVD-2026-66574 CRITICAL

2026-08-26 Linux

GHSA-cvmj-7cw8-3rr5

Denial Of Service Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Requires a non-default ipvlan-over-headroom-device stack configured locally (AC:H, PR:L) and manifests as a kernel crash, so impact is availability-only (A:H, C:N/I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 06:27 vuln.today

CVSS changed

Aug 27, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 26, 2026 - 16:17 EUVD

CVE Published

Aug 26, 2026 - 14:36 cve.org

CRITICAL 9.8

CVE Published

Aug 26, 2026 - 14:36 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0.

When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.

This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom.

Fix this by:

Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init().
Propagating needed_headroom and needed_tailroom updates to attached ipvlans

in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.

Articles & Coverage 1

News Critical Memory Corruption in Linux Kernel ipvlan Driver - CVE-2026-74744 Aug 27, 2026

AnalysisAI

Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host configured with ipvlan over macsec/WireGuard/tunnel

Delivery

Traffic sent through ipvlan device

Exploit

Header prepend into under-reserved skb headroom

Execution

Headroom underflow / slab-use-after-free

Impact

Kernel crash and denial of service

Access

Host configured with ipvlan over macsec/WireGuard/tunnel

Delivery

Traffic sent through ipvlan device

Exploit

Header prepend into under-reserved skb headroom

Execution

Headroom underflow / slab-use-after-free

Impact

Kernel crash and denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires a specific non-default configuration: an ipvlan device must be attached to a parent (or stacked lower) device that itself requires extra headroom or tailroom - explicitly macsec, IPsec, WireGuard, GRE/VXLAN tunnels, or veth configured with rx headroom. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict sharply and warrant skepticism of the 9.8 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	On a host where ipvlan is layered over a WireGuard or macsec interface, traffic pushed through the ipvlan device causes the stack to prepend headers into insufficiently reserved skb headroom, underflowing the buffer and triggering a slab-use-after-free that panics or destabilizes the kernel. No public POC is available, and the practical outcome observed in the report is a KASAN-detected crash (denial of service); reliable code execution from the UAF would require additional exploitation research not present in the source data.
Remediation	Apply the vendor kernel update for your branch: upgrade to 6.1.184, 6.6.153, 6.12.105, 6.18.46, or 7.1.10 (or later), matching your stable series, using the patched builds referenced in ENISA EUVD-2026-66574 and the git.kernel.org stable commits (e.g. … Detailed patch versions, workarounds, and compensating controls in full report.