SB20260827132 - Improper Initialization in Linux kernel net driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-74742)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper initialization in veth_poll when handling packet processing on a multi-queue setup with GRO enabled and no XDP program attached. A remote attacker can trigger traffic that causes a peer transmit queue to remain stopped indefinitely to cause a denial of service.

The issue affects the plain GRO/NAPI path because the queue index used to wake the peer transmit queue remains incorrect unless an XDP program has been attached.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/60db47f02bfa2aa688938aa199117ec4f8e31d23
• https://git.kernel.org/stable/c/73f8dd22b1e533a99ecc3f9b5de6c6daccaecace
• https://git.kernel.org/stable/c/90bb11fb29d3c55a2c46dc7c386d096b286e7fcf
• https://git.kernel.org/stable/c/b662a1fb4f3a5ea19bac24eea8315b1d05be51e7