CVE-2026-74478

um: vector: fix use-after-free in vector_mmsg_rx()

9.8 CriticalFix available

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path.

Discard the slot the same way the other paths do before continuing.

Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.57%Up 0.4 points since Aug 16, 2026

What each source reports

CVE List Score used 9.8

um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

Discard the slot the same way the other paths do before continuing.

Record: CVE-2026-74478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-59671 9.8

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

Discard the slot the same way the other paths do before continuing.

Record: EUVD-2026-59671
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mhmm-jqvj-99w7 9.8

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after...

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

Discard the slot the same way the other paths do before continuing.

Record: GHSA-mhmm-jqvj-99w7
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 9.8

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

Discard the slot the same way the other paths do before continuing.

Record: CVE-2026-74478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-74478 9.8

Record: BELL-CVE-2026-74478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved:

um: vector: fix use-after-free in vector_mmsg_rx()

When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop:

if (header_check < 0) {
	dev_kfree_skb_irq(skb);
	vp->estats.rx_encaps_errors++;
	continue;
}

The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors:

(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;

Discard the slot the same way the other paths do before continuing.

Record: CVE-2026-74478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 12 moreShow less

OSVDEBIAN-CVE-2026-74478 9.8

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; continue; } The normal and short-packet paths fall through to the bottom of the loop body, which clears the consumed slot and advances the cursors: (*skbuff_vector) = NULL; mmsg_vector++; skbuff_vector++; The verify_header() < 0 path skips that via continue, so the freed skb is left in skbuff_vector[] and the cursors do not advance. The next iteration reads the same slot, gets the freed skb, and frees it again, producing a refcount underflow / use-after-free in the RX path. Discard the slot the same way the other paths do before continuing. Only transports whose verify_header() can return negative are affected: GRE and L2TPv3 do so on a cookie/session-id mismatch (raw/tap do not), so any peer on such a transport can trigger it without authentication.

Record: DEBIAN-CVE-2026-74478
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-74478 9.2

Record: UBUNTU-CVE-2026-74478
CVSS 4.0: 9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-10

OSVUSN-8781-1 No score

linux-nvidia-tegra vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)