CVE-2026-74684: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

The commit 4f61f133f354 ("net: tap: NULL pointer derefence in
dev_parse_header_protocol when skb->dev is null") fixed a crash in
tap_get_user() by assigning skb->dev before calling tun_vnet_hdr_to_skb().
This is required because virtio_net_hdr_to_skb() may invoke
dev_parse_header_protocol(), which dereferences skb->dev. Without the
assignment, a NULL pointer dereference can occur.

However, tap_get_user_xdp() still parses the virtio-net header before
assigning skb->dev. When the vhost TX path passes an XDP buffer containing
a GSO virtio-net header but the protocol is set to zero on purpose,
tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol() while skb->dev
is still NULL, resulting in a crash.

Fix this by looking up the tap device and assigning skb->dev before calling
tun_vnet_hdr_to_skb(), matching the ordering already used in
tap_get_user(). Preserve the existing RCU read-side critical section across
dev_queue_xmit().

The Linux kernel CVE team has assigned CVE-2026-74684 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 6.18.45 with commit 8b444b126cd8e4473e652f529753ed4dd1360a9c
	Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.1.9 with commit 164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b
	Issue introduced in 5.12 with commit 924a9bc362a5223cd448ca08c3dde21235adc310 and fixed in 7.2 with commit 3874892dd27d5387aa9a06f58d9060f18f351d24
	Issue introduced in 4.14.226 with commit ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d
	Issue introduced in 4.19.181 with commit 54ef8243c3c8e90f1ea5792e6752e021a25c8eb3
	Issue introduced in 5.4.106 with commit ca278267d6cd9544645731732455b6b20cb0e895
	Issue introduced in 5.10.24 with commit faa3baa2828c5e1c4374f3e60041f75c64f5fcb6
	Issue introduced in 5.11.7 with commit 99b1d3f74b9ef72c2f74c8e4c078e1bc0706e748

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74684
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/tap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8b444b126cd8e4473e652f529753ed4dd1360a9c
	https://git.kernel.org/stable/c/164c31ee252ebd1ac8f44c2dfc5486b6d9a0379b
	https://git.kernel.org/stable/c/3874892dd27d5387aa9a06f58d9060f18f351d24