Use-After-Free Vulnerability in Linux Kernel UDP Processing

CVE-2026-74705

What is CVE-2026-74705?

A vulnerability exists in the Linux kernel's handling of UDP tunnels, specifically within the __skb_udp_tunnel_segment() function. The issue arises when the function attempts to access the UDP header without confirming that the tunnel header is properly positioned at the start of the socket buffer (skb). If a pull operation reallocates skb->head, the previously saved pointer to the UDP header may become invalid, potentially leading to a use-after-free condition. A fix has been implemented to ensure that the UDP header is accessed only after the tunnel header has been properly established, enhancing overall network security and stability.

References