CVE-2026-74476

In the Linux kernel, the following vulnerability has been resolved:

veth: convert frag_list skbs before running XDP

A frag_list skb can reach veth with data_len set but nr_frags zero.

veth_convert_skb_to_xdp_buff() only converts skbs that are shared,

locked, have frags[], or do not have enough headroom. It later uses

skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and

xdp_frags_size.

That exposes frag_list data to XDP as if it were stored in frags[], but

frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment

metadata, walk an empty fragment entry, and crash in memcpy() from

__xsk_rcv().

Route non-linear skbs through skb_pp_cow_data() before exposing them to

XDP, and only advertise XDP frags when the resulting skb has frags[].

skb_copy_bits() already handles frag_list input, and skb_pp_cow_data()

builds frags[] output with skb_add_rx_frag(), which is the

representation XDP multi-buffer expects.