DEBIAN-CVE-2026-74476

In the Linux kernel, the following vulnerability has been resolved:  veth: convert fraglist skbs before running XDP  A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skbisnonlinear() to decide whether to set XDPFLAGSHASFRAGS and xdpfragssize.  That exposes fraglist data to XDP as if it were stored in frags[], but frags[] is empty. AFXDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from _xskrcv().  Route non-linear skbs through skbppcowdata() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skbcopybits() already handles fraglist input, and skbppcowdata() builds frags[] output with skbaddrxfrag(), which is the representation XDP multi-buffer expects.