In the Linux kernel, the following vulnerability has been resolved:

udp: fix potential use-after-free in tunnel segmentation

__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.

Get the UDP header after the pull to avoid a potential use-after-free.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 6a733a38b983d8c2e222f13968209010cf44de87
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 19d89b13a43640b2da2f277ee462d919d988cb6f
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < b3df61bb745eb5201eac22679a2839d4ccbf3442
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 1ae134c012e10384cdac420b5cc6e0615cde0b55
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 5161e67c561c4f28a5d9335a6e859b02511de92b
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 64d322c288577793eedd352b96ef75234ed380fe
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < 588d4a6795d99d080f74ef0b5f391ea8c453ae5d
dbef491ebe7f3a4fb1b9111878b86a426fd540b7 affected < d0f86fb36eb260abd10007b62c9dcc1028e03e61
Linux Linux affected
Version Status Constraints
4.6 affected —
0 unaffected < 4.6
5.10.265 unaffected ≤ 5.10.*
5.15.216 unaffected ≤ 5.15.*
6.1.183 unaffected ≤ 6.1.*
6.6.152 unaffected ≤ 6.6.*
6.12.104 unaffected ≤ 6.12.*
6.18.45 unaffected ≤ 6.18.*
7.1.9 unaffected ≤ 7.1.*
7.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f cve-icon
https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55 cve-icon
https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b cve-icon
https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d cve-icon
https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe cve-icon
https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87 cve-icon
https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442 cve-icon
https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61 cve-icon
History

Sat, 22 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid. Get the UDP header after the pull to avoid a potential use-after-free.
Title udp: fix potential use-after-free in tunnel segmentation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-22T15:33:04.110Z

Reserved: 2026-08-15T05:44:03.927Z

Link: CVE-2026-74705

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.