Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74743— macvlan: inherit needed_headroom and needed_tailroom from lowerdev

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： macvlan：从底层设备继承 needed_headroom 和 needed_tailroom macvlan 设备在 中会从底层设备（lowerdev）继承 ，但 和 仍保持为 0。 当底层设备需要额外的头部或尾部空间来容纳头部/尾部数据（例如 macsec、ipsec、wireguard、隧道或带有 rx headroom 的 veth 等）时，上层在计算数据包所需的头部和尾部空间时无法预留足够的空间。 这可能导致： 内存重新分配带来的开销； skb（套接字缓冲区）

CVSS 9.8 · Critical

Possible ATT&CK Techniques 1 AI

T1555 · Credentials from Password Stores

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< 8cd90e850e434577bf6774778657d26d6995e53f affected
b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< 28afc87bd8da0b3348bbbd834c8a89e83712cf5e affected
b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< 8f6a05dbac05725e0786701eb04778c5bdbe4eaa affected
b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< 96fa90b74385b7f2b0d97251dd43d5ee6ca44668 affected
b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< bc9a00fb78e32bccc39d763bfd13a450705bac5d affected
b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53< cef51860becd9700217c81732ca1eb1ea6ed6fe1 affected
2.6.23 affected
< 2.6.23 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74743

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 ~ 8cd90e850e434577bf6774778657d26d6995e53f -
Linux Linux 2.6.23 -

II. Public POCs for CVE-2026-74743

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74743

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74743 (6)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-74744 9.8 CRITICAL ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
CVE-2026-74752 9.8 CRITICAL sctp: validate cookie AUTH state before use
CVE-2026-80586 9.8 CRITICAL mptcp: options: reset DSS fields in case of unexpected size
CVE-2026-80519 9.8 CRITICAL ovpn: finish crypto callback cleanup before peer release
CVE-2026-80558 9.8 CRITICAL libceph: Avoid using invalid osd indices from primary_temp
CVE-2026-74746 9.8 CRITICAL netfilter: flowtable: publish GC-visible tuple last
CVE-2026-80561 9.8 CRITICAL libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-80528 9.8 CRITICAL ceph: avoid fs reclaim while using current->journal_info
CVE-2026-80587 9.8 CRITICAL mptcp: avoid combining some incoming suboptions
CVE-2026-80557 9.8 CRITICAL libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-74737 9.8 CRITICAL net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
CVE-2026-80589 9.8 CRITICAL block: stop the timeout timer when releasing a never added disk
CVE-2026-80585 9.4 CRITICAL mptcp: fastopen: only mark MPTFO subflows with SYN data
CVE-2026-74751 9.4 CRITICAL riscv: lib: Fix ZBB strnlen reading past count boundary
CVE-2026-80551 9.3 CRITICAL s390/vfio_ccw: Ensure first IDAW remains constant
CVE-2026-80554 9.3 CRITICAL s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80552 8.8 HIGH s390/vfio_ccw: Ensure index for read/write regions are within range
CVE-2026-80553 8.8 HIGH s390/vfio_ccw: Cancel existing workqueues
CVE-2026-80547 8.8 HIGH s390/vfio_ccw: Implement a crw lock
CVE-2026-80576 8.8 HIGH drm/amdgpu: reject oversized IBs with per-ring packet limits

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74743

No comments yet

Leave a comment