CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

udp: fix potential use-after-free in tunnel segmentation

__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.

Get the UDP header after the pull to avoid a potential use-after-free.

The Linux kernel CVE team has assigned CVE-2026-74705 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 5.10.265 with commit 6a733a38b983d8c2e222f13968209010cf44de87
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 5.15.216 with commit 19d89b13a43640b2da2f277ee462d919d988cb6f
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 6.1.183 with commit b3df61bb745eb5201eac22679a2839d4ccbf3442
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 6.6.152 with commit 1ae134c012e10384cdac420b5cc6e0615cde0b55
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 6.12.104 with commit 5161e67c561c4f28a5d9335a6e859b02511de92b
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 6.18.45 with commit 64d322c288577793eedd352b96ef75234ed380fe
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 7.1.9 with commit 588d4a6795d99d080f74ef0b5f391ea8c453ae5d
	Issue introduced in 4.6 with commit dbef491ebe7f3a4fb1b9111878b86a426fd540b7 and fixed in 7.2 with commit d0f86fb36eb260abd10007b62c9dcc1028e03e61

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74705
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/udp_offload.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87
	https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f
	https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442
	https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55
	https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b
	https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe
	https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d
	https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61