Loading story…
The Linux kernel assigned CVE-2026-74684 to a denial-of-service flaw in the TAP networking path that can allow a malicious guest VM using virtio-net to panic its host. The condition affects configurations using vhost-net with a TAP-backed interface, including macvtap; crafted malformed packets can reach the vulnerable processing path and crash the host kernel. A mainline fix was merged in commit 3874892dd27d5387aa9a06f58d9060f18f351d24.
The defect is related to CVE-2022-50073: its earlier remediation covered tap_get_user() but omitted tap_get_user_xdp(). The issue follows prior scrutiny of ownership handling in Linux TUN/TAP drivers, including a 2023 patch series proposing sk_uid initialization from current_fsuid() for issues associated with CVE-2023-1076; however, the newly assigned CVE concerns the missed XDP packet-ingestion path and guest-to-host crash risk.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Laszlo Ersek publicly submitted a two-patch series to re-fix CVE-2023-1076 in the Linux TUN/TAP drivers after determining the prior fixes were incorrect. The patches set sk_uid from current_fsuid() in tun_chr_open() and tap_open(), and Ersek reported reproducing the issue in both TUN and TAP.
A Linux kernel TAP networking flaw that can let a virtio-net guest send malformed packets and panic a vulnerable vhost-net host was assigned CVE-2026-74684. The affected configuration includes a TAP backend such as macvtap, although other TAP device users may also be affected.
A fix titled "net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()" was merged into the mainline Linux kernel as commit 3874892dd27d5387aa9a06f58d9060f18f351d24. The change addresses an uncovered path left by the earlier CVE-2022-50073 fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2020-27152** affects the Linux kernel's KVM hypervisor and can let a malicious or untrusted guest trigger a host-kernel stack overflow. The flaw arises during interrupt processing when lazy IOAPIC updates incorrectly set IRQ state, producing an infinite loop that exhausts the host stack and crashes the kernel. The issue creates a guest-to-host denial-of-service risk for systems running KVM workloads, potentially disrupting every virtual machine on an affected host. Upstream Linux addressed the vulnerability in commit `77377064c3a94911339f13ce113b3abf265e06da`; organizations should apply kernel updates incorporating that fix and prioritize KVM hosts exposed to untrusted tenants or guest administrators.
Aug 29, 2026
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026