Improper Initialization in Linux kernel - CVE-2026-74742

Vulnerability identifier: #VU145986

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74742

CWE-ID: CWE-665

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper initialization in veth_poll when handling packet processing on a multi-queue setup with GRO enabled and no XDP program attached. A remote attacker can trigger traffic that causes a peer transmit queue to remain stopped indefinitely to cause a denial of service.

The issue affects the plain GRO/NAPI path because the queue index used to wake the peer transmit queue remains incorrect unless an XDP program has been attached.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/60db47f02bfa2aa688938aa199117ec4f8e31d23
• https://git.kernel.org/stable/c/73f8dd22b1e533a99ecc3f9b5de6c6daccaecace
• https://git.kernel.org/stable/c/90bb11fb29d3c55a2c46dc7c386d096b286e7fcf
• https://git.kernel.org/stable/c/b662a1fb4f3a5ea19bac24eea8315b1d05be51e7

• Improper Initialization in Linux kernel net driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more