CVE-2026-74476

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A fraglist skb can reach veth with datalen set but nr_frags zero.

vethconvertskbtoxdp_buff() only converts skbs that are shared,

locked, have frags[], or do not have enough headroom. It later uses

skbisnonlinear() to decide whether to set XDPFLAGSHAS_FRAGS and

xdpfragssize.

That exposes frag_list data to XDP as if it were stored in frags[], but

frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment

metadata, walk an empty fragment entry, and crash in memcpy() from

_xskrcv().

Route non-linear skbs through skbppcow_data() before exposing them to

XDP, and only advertise XDP frags when the resulting skb has frags[].

skbcopybits() already handles fraglist input, and skbppcowdata()

builds frags[] output with skbaddrx_frag(), which is the

representation XDP multi-buffer expects.