NULL Pointer Dereference in Linux Kernel's Networking Component by Vendor

CVE-2026-74684

What is CVE-2026-74684?

A vulnerability in the Linux kernel's networking component can lead to a NULL pointer dereference when handling virtio net headers during the tap_get_user_xdp() process. This occurs specifically when an XDP buffer is processed with a GSO virtio-net header, which has a deliberately set protocol field of zero. If skb->dev isn’t assigned before invoking the tun_vnet_hdr_to_skb() function, this can result in a crash, as dev_parse_header_protocol() attempts to dereference a NULL pointer. The fix involves properly assigning skb->dev before this function call, aligning with established procedures in the tap_get_user() function to prevent such crashes.

References