External risk intelligence

Linux kernel VXLAN header pull vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74474

This vulnerability exists within the Linux kernel's VXLAN implementation, specifically regarding how network headers are pulled during the transmit path. It is a low-level internal kernel function for packet processing, not a service or application directly exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a Linux kernel vulnerability within its VXLAN networking function that could lead to a critical security flaw if exploited. The issue stems from how the kernel handles network headers during data transmission, potentially leaving parts of critical information vulnerable in fragmented data.

A flaw in network data handling.
Affects kernel's VXLAN networking functions.
Confirm relevance and exposure; critical potential.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by sending specially crafted network packets. The Linux kernel's VXLAN (Virtual Extensible LAN) component, when processing these packets for transmission, incorrectly handles network header information. This misprocessing could allow an attacker to corrupt data or gain unauthorized access.

No special access needed.
Malicious network packets trigger vulnerability.
Risk of data corruption or unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's VXLAN implementation could affect network packet processing during the transmit path. When handling certain network headers, an incorrect offset calculation may lead to malformed packets, potentially impacting network service stability or data integrity.

Network packet headers could be affected.
Incorrect offset calculations may occur.
Network service stability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Linux kernel's VXLAN implementation, specifically how network headers are processed during transmission. Ownership will likely fall to the Linux infrastructure or platform teams responsible for kernel management. The first practical step is to identify all Linux systems utilizing VXLAN, confirm their exposure and criticality, and then engage the accountable team for remediation planning.

Linux infrastructure/platform teams own.
Verify VXLAN usage and exposure.
Plan kernel updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel VXLAN component?

VXLAN, or Virtual Extensible LAN, is a network virtualization technology built into the Linux kernel. It allows systems to create virtualized, scalable network overlays across different physical infrastructures, commonly used in cloud environments and container orchestration platforms to connect services across separate hosts.

How does CVE-2026-74474 impact packet processing?

This vulnerability involves an improper boundary check during the transmission of network packets. Because the software failed to account for the MAC header offset when verifying available data, the kernel may incorrectly process network headers. This flaw can lead to memory or data handling errors when parts of a packet are stored in non-linear memory segments.

Do I need to send specific traffic to trigger this bug?

Yes, an attacker would need to send specially crafted network packets that the kernel then processes for transmission. Simply having VXLAN enabled does not trigger the flaw; the vulnerability specifically manifests when the kernel handles these malformed packets during the transmit path, causing the header pull mechanism to miscalculate the necessary data offsets.

Is my system at risk based on Halo Surface Signal?

Halo Surface Signal indicates the risk is very unlikely because this flaw exists deep within low-level kernel functions for internal packet processing. It is not a user-facing service or application directly exposed to the internet. While critical in nature, it generally requires specific, low-level network interactions rather than common web-based attacks.

When should I prioritize a response to this vulnerability?

You should prioritize a response if your infrastructure relies heavily on Linux-based VXLAN for internal network traffic. The first step is to identify all systems running Linux kernels with VXLAN enabled. Coordinate with your platform or infrastructure teams to verify your specific configuration and plan for the appropriate kernel updates to address the offset calculation error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.