CVE-2026-74701

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/openvswitch: check Ethernet header length in key_extract()<br /> <br /> When a packet arrives on an ARPHRD_NONE device (e.g. TUN),<br /> ovs_flow_key_extract() trusts the user-provided skb-&gt;protocol field: if<br /> it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and<br /> key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes<br /> of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes<br /> for MAC addresses and parse_ethertype() pulls 2 more, either of which<br /> triggers a kernel BUG in __skb_pull() when the linear area is too small.<br /> <br /> kernel BUG at include/linux/skbuff.h:2848!<br /> RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933<br /> ovs_flow_key_extract+0x419/0xa70<br /> ovs_vport_receive+0x222/0x390<br /> netdev_frame_hook+0x3e0/0x630<br /> tun_get_user+0x2d0c/0x38e0<br /> <br /> Fixed by calling check_header() in key_extract() before accessing the<br /> Ethernet header.