CVE-2026-74476 is a memory corruption vulnerability in the Linux kernel's veth driver that occurs when handling multi-buffer frames through the XDP (eXpress Data Path) redirect path. The bug manifests when AF_XDP copy mode forwards skbs in the frag_list representation (chained SKBs) to the veth XDP consumer, which incorrectly treats them as if they use the frags[] representation (page fragments with explicit size metadata). This mismatch produces bogus XDP fragment metadata that can corrupt memory during packet processing.
The vulnerability isn't a coding error in the traditional sense — the veth XDP path's assumption that it would only receive frags[] representations was reasonable when written. The problem emerged when AF_XDP copy mode expanded to support multi-buffer frames and began passing frag_list representations that the veth path hadn't anticipated. This is a temporal coupling failure: correct assumptions became dangerous as the ecosystem evolved around them.
The fix uses skb_pp_cow_data() to normalize frag_list skbs to the frags[] representation before XDP processing — the correct abstraction already existed in the page_pool infrastructure but wasn't enforced at the veth/XDP boundary. This reveals a deeper pattern: the kernel excels at hardening paths with clear ownership but consistently fails at boundaries between driver, network stack, and user-facing APIs where no single subsystem controls the contract.
What makes this severity 9.1 is the blast radius amplification. The veth driver is the primary mechanism for crossing network namespace boundaries — a frag_list skb corrupted in XDP copy mode crosses that boundary carrying false metadata, undermining the isolation that namespaces are supposed to enforce. Additionally, XDP operates at wire speed without the normal kernel safety nets, so the trust cascade from veth to AF_XDP amplifies the impact beyond what a similar flaw in a slow path would cause.
To verify whether your systems are exposed: check the kernel version running on hosts with veth interfaces used for namespace isolation or XDP workloads. The vulnerability affects any AF_XDP zero-copy or copy mode path that can receive multi-buffer frames. Review whether your configuration uses AF_XDP with multi-buffer support (the 'xdp_mb' flag or similar) and whether veth interfaces are in the redirect path. If you're using older kernels with veth+XDP, treat namespace-to-namespace traffic as potentially affected until patched. Note that the fix incurs a cow-and-reassemble cost at a performance-critical path — monitor for any latency regression in XDP redirect workloads after patching.