The Linux kernel vulnerability CVE-2026-74665 involves improper length accounting in socket buffers (skb) after generic XDP fragment adjustments. When an XDP program modifies the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len unchanged, causing skb_headlen() to overestimate the linear data length. This leads to __skb_datagram_iter() copying data beyond the actual linear tail into userspace, including kernel pointers and skb metadata such as nr_frags and xdp_frags_size. The flaw was demonstrated with a 60000-byte UDP datagram on a veth pair with MTU 64000, which was shortened by 1024 bytes in the fragment area, causing corrupted payloads. The patch corrects this by subtracting the old data_len before replacing it and adding the new data_len afterwards, keeping skb->len and skb->data_len synchronized.

The vulnerability allows copying of kernel memory beyond the intended packet data to userspace, including kernel pointers and internal skb metadata. This could lead to information disclosure of kernel memory contents. Additionally, the actual packet payload is corrupted and truncated, which could disrupt network communication. There is no indication of remote code execution or privilege escalation from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel to correctly synchronize skb->len and skb->data_len after generic XDP fragment adjustments. Users should apply the official kernel update that includes this fix. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.