Out-of-bounds read in Linux kernel - CVE-2026-74701

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in key_extract() in the Open vSwitch flow extraction logic when processing a packet on an ARPHRD_NONE device with a user-controlled protocol field indicating Ethernet. A local user can send a specially crafted packet with an insufficient linear header to cause a denial of service.

The issue is triggered when the packet is received from devices such as TUN.

Affected software

How to mitigate CVE-2026-74701

External References

• https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927
• https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9
• https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466
• https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699
• https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15
• https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae
• https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290
• https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1

Related Security Bulletins

• Out-of-bounds read in Linux kernel openvswitch
• Debian update for linux