External risk intelligence

Linux Kernel Use-After-Free Vulnerability in Vector Packet Handling.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74478

The vulnerability affects specific Linux kernel vector network transports (GRE and L2TPv3) used in User-Mode Linux. While these protocols can be internet-reachable, they are typically used for site-to-site tunneling or specific virtualized infrastructure rather than common public-facing web or gateway services, making internet exposure possible but not a standard deployment pattern.

Use After Free

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's network handling could allow unauthenticated attackers to trigger a use-after-free condition, potentially leading to system instability or compromise. The issue is specifically tied to how certain network transports handle packet verification errors.

Kernel flaw allows unauthorized access.
Affects specific network protocols, not all systems.
Confirm relevance and exposure for your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component over the network by sending specially crafted packets to affected Linux kernel transports like GRE or L2TPv3. If the packet's overlay header verification fails, the system attempts to free the same packet buffer twice, leading to a critical memory corruption vulnerability. This could allow an unauthenticated attacker to crash the system or potentially execute arbitrary code.

Network access required.
Failing packet header verification triggers.
Critical memory corruption risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system stability and data integrity within the Linux kernel's network processing when specific transports like GRE or L2TPv3 encounter header verification failures. When these failures occur, the system may attempt to free already freed memory, potentially leading to crashes or unpredictable behavior. The exposure is limited to network transports that support negative return values from `verify_header()`, specifically GRE and L2TPv3.

System stability and data integrity.
Malicious network traffic triggers a race condition.
Kernel crash or memory corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's network packet handling, specifically affecting GRE and L2TPv3 transports, requires immediate attention from infrastructure and platform teams. The first practical step is to identify all systems running the affected kernel versions, confirm whether these specific network transports are enabled and reachable externally, and then ascertain the business criticality of those systems. Once accountable owners are identified, remediation efforts can be prioritized based on the assessed risk.

Infrastructure and platform teams own remediation.
Verify GRE/L2TPv3 usage and external reachability.
Plan targeted maintenance for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel component affected by CVE-2026-74478?

This vulnerability resides in the User-Mode Linux (UML) vector network transport driver. This component allows virtualized instances of the Linux kernel to handle network traffic. It is primarily used to facilitate virtualized networking environments, acting as a bridge for data packets between virtual machines or network namespaces and the host system.

How does this vulnerability work in simple terms?

This is a use-after-free vulnerability, which is a type of memory corruption. In this case, the software encounters an error while verifying a data packet and incorrectly handles the memory associated with that packet. Because the system fails to clear its record of the packet, it may attempt to process or release that same memory again later. This double-handling can crash the system or allow for unintended memory manipulation.

What triggers this memory corruption bug?

An attacker triggers the bug by sending a network packet that fails the header verification process within the GRE or L2TPv3 transport protocols. It is important to note that transports like raw or tap do not have this issue, so they are not affected. If a system is not configured to use GRE or L2TPv3 for its virtual networking, this specific trigger path is not available to an attacker.

Do I need to worry about my internet-facing services?

According to Halo Surface Signal, this vulnerability is not a typical threat for common web services. While these protocols can be accessed over the internet, they are usually reserved for specialized site-to-site tunnels or virtualized infrastructure. You should evaluate if your systems use these specific transport protocols and if they are reachable from untrusted networks to determine your actual risk.

What are the first steps to address this issue?

Start by identifying all systems in your environment that are running a kernel version containing this code. Next, check if your configurations actively utilize GRE or L2TPv3 transport protocols. Once you have a list of systems where these protocols are both enabled and potentially reachable, prioritize them for updates or network segmentation based on the sensitivity of the data they handle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.