net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74684
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:42 UTC
Updated2026-08-22 16:16:42 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb(). This is required because virtio_net_hdr_to_skb() may invoke dev_parse_header_protocol(), which dereferences skb->dev. Without the assignment, a NULL pointer dereference can occur. However, tap_get_user_xdp() still parses the virtio-net header before assigning skb->dev. When the vhost TX path passes an XDP buffer containing a GSO virtio-net header but the protocol is set to zero on purpose, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev is still NULL, resulting in a crash. Fix this by looking up the tap device and assigning skb->dev before calling tun_vnet_hdr_to_skb(), matching the ordering already used in tap_get_user(). Preserve the existing RCU read-side critical section across dev_queue_xmit().

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 924a9bc362a5223cd448ca08c3dde21235adc310 8b444b126cd8e4473e652f529753ed4dd1360a9c git Not specified
CNA Linux Linux affected 924a9bc362a5223cd448ca08c3dde21235adc310 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b git Not specified
CNA Linux Linux affected 924a9bc362a5223cd448ca08c3dde21235adc310 3874892dd27d5387aa9a06f58d9060f18f351d24 git Not specified
CNA Linux Linux affected ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d git Not specified
CNA Linux Linux affected 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3 git Not specified
CNA Linux Linux affected ca278267d6cd9544645731732455b6b20cb0e895 git Not specified
CNA Linux Linux affected faa3baa2828c5e1c4374f3e60041f75c64f5fcb6 git Not specified
CNA Linux Linux affected 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748 git Not specified
CNA Linux Linux affected 4.14.226 4.15 semver Not specified
CNA Linux Linux affected 4.19.181 4.20 semver Not specified
CNA Linux Linux affected 5.4.106 5.5 semver Not specified
CNA Linux Linux affected 5.10.24 5.11 semver Not specified
CNA Linux Linux affected 5.11.7 5.12 semver Not specified
CNA Linux Linux affected 5.12 Not specified
CNA Linux Linux unaffected 5.12 semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report