In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet… (CVE-2026-74701)
A vulnerability in the Linux kernel's Open vSwitch component was resolved involving improper validation of Ethernet header length in the key_extract() function. When packets arrive on ARPHRD_NONE devices like TUN, the code trusted a user-provided protocol field without ensuring sufficient linear data length, leading to a kernel BUG due to out-of-bounds memory access. The issue was fixed by adding a check_header() call before accessing the Ethernet header.
AI Analysis
Technical Summary
The Linux kernel Open vSwitch implementation had a vulnerability (CVE-2026-74701) where ovs_flow_key_extract() trusted the skb->protocol field for packets arriving on ARPHRD_NONE devices (e.g., TUN). If the protocol was ETH_P_TEB, the packet was classified as MAC_PROTO_ETHERNET and key_extract() was called without verifying that the skb contained the minimum Ethernet header length (ETH_HLEN, 14 bytes). key_extract() then unconditionally accessed MAC addresses and ethertype fields, which could trigger a kernel BUG in __skb_pull() due to insufficient linear data length. The fix involved calling check_header() in key_extract() to validate the Ethernet header length before access.
Potential Impact
This vulnerability can cause a kernel BUG (crash) when processing specially crafted packets on ARPHRD_NONE devices, potentially leading to denial of service. There is no indication of privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix is available as the vulnerability has been resolved by adding a header length check in key_extract(). Users should apply the official Linux kernel patches that include this fix. No additional mitigation is indicated by the vendor advisory.
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet… (CVE-2026-74701)
Description
A vulnerability in the Linux kernel's Open vSwitch component was resolved involving improper validation of Ethernet header length in the key_extract() function. When packets arrive on ARPHRD_NONE devices like TUN, the code trusted a user-provided protocol field without ensuring sufficient linear data length, leading to a kernel BUG due to out-of-bounds memory access. The issue was fixed by adding a check_header() call before accessing the Ethernet header.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel Open vSwitch implementation had a vulnerability (CVE-2026-74701) where ovs_flow_key_extract() trusted the skb->protocol field for packets arriving on ARPHRD_NONE devices (e.g., TUN). If the protocol was ETH_P_TEB, the packet was classified as MAC_PROTO_ETHERNET and key_extract() was called without verifying that the skb contained the minimum Ethernet header length (ETH_HLEN, 14 bytes). key_extract() then unconditionally accessed MAC addresses and ethertype fields, which could trigger a kernel BUG in __skb_pull() due to insufficient linear data length. The fix involved calling check_header() in key_extract() to validate the Ethernet header length before access.
Potential Impact
This vulnerability can cause a kernel BUG (crash) when processing specially crafted packets on ARPHRD_NONE devices, potentially leading to denial of service. There is no indication of privilege escalation or code execution from the provided data.
Mitigation Recommendations
A fix is available as the vulnerability has been resolved by adding a header length check in key_extract(). Users should apply the official Linux kernel patches that include this fix. No additional mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6727-4wmg-w3rc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74701"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f1acd9273b499bc77e
Added to database: 08/22/2026, 22:51:29 UTC
Last enriched: 08/23/2026, 00:23:54 UTC
Last updated: 08/23/2026, 01:32:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.