CVE-2026-74684: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74684 is a NULL pointer dereference vulnerability in the Linux kernel's TAP network driver affecting the XDP (eXpress Data Path) packet handling code path. The flaw exists in tap_get_user_xdp(), which parses a virtio-net header before assigning the network device pointer (skb->dev), allowing a kernel crash when processing GSO virtio-net headers with a zero protocol field. Affected kernel versions span from 4.14.226 through 5.11.x (up to 5.12), with fixes available in stable releases 6.18.45, 7.1.9, and 7.2. The CVSS score has not yet been formally assigned by NVD; Feedly estimates the severity as Medium (Feedly, Github Advisory).

The root cause is a NULL pointer dereference (CWE-476) in drivers/net/tap.c. A prior fix (commit 4f61f133f354) correctly ordered skb->dev assignment before virtio-net header parsing in tap_get_user(), but the analogous XDP code path tap_get_user_xdp() was not updated. When the vhost TX path submits an XDP buffer with a GSO virtio-net header and a zero protocol field, tun_vnet_hdr_to_skb() internally calls dev_parse_header_protocol(), which dereferences skb->dev while it is still NULL. The fix reorders operations in tap_get_user_xdp() to look up the tap device and assign skb->dev before invoking tun_vnet_hdr_to_skb(), and preserves the RCU read-side critical section across dev_queue_xmit() (Github Advisory, Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a denial of service affecting the entire host. Because the crash occurs in kernel space, all workloads running on the affected host (including other virtual machines or containers) are disrupted. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, Github Advisory).

Exploitation requires local access — specifically, the ability to send crafted packets through the vhost TX path, such as from a virtual machine or container with vhost device access. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is reported as 0.0 (Feedly, Github Advisory).

1. Gain local access: Obtain access to a virtual machine or container that has access to a vhost TAP device on a host running a vulnerable Linux kernel (versions 5.12 through pre-fix stable releases).
2. Craft a malicious XDP buffer: Construct an XDP buffer containing a GSO virtio-net header with the protocol field explicitly set to zero.
3. Inject via vhost TX path: Submit the crafted XDP buffer through the vhost TX path, causing tap_get_user_xdp() to be invoked on the host kernel.
4. Trigger NULL dereference: The kernel calls tun_vnet_hdr_to_skb() before skb->dev is assigned; this internally calls dev_parse_header_protocol(), which dereferences the NULL skb->dev pointer.
5. Kernel crash: The NULL pointer dereference causes a kernel panic, crashing the host and denying service to all workloads (Feedly, Github Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing a NULL pointer dereference in tap_get_user_xdp(), tun_vnet_hdr_to_skb(), or dev_parse_header_protocol(); stack traces involving drivers/net/tap.c.
• System Behavior: Unexpected host system crash or reboot, particularly in environments running virtual machines or containers with vhost TAP device access.
• Process: Unusual activity from vhost worker threads (vhost-*) immediately preceding a kernel crash.

Apply the upstream Linux kernel patches fixing the operation ordering in tap_get_user_xdp(): commits 8b444b126cd8, 164c31ee252e, and 3874892dd27d for affected stable branches. Patched stable releases include kernel versions 6.18.45, 7.1.9, and 7.2. As an interim workaround, restrict access to vhost devices to trusted users only, and disable XDP on TAP devices if not required in your environment (Feedly, Github Advisory).