{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74582","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.918Z","datePublished":"2026-08-21T16:31:55.283Z","dateUpdated":"2026-08-25T05:40:08.843Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-25T05:40:08.843Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev->hard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb->data back by reserve\nthen places it before skb->head, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops->create is not addressed here."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/packet/af_packet.c"],"versions":[{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"91f041451f967cd87ed722a8f43c0b767a64f1a0","status":"affected","versionType":"git"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"9052756290962ffb9a661bcf319e92dedaaedfed","status":"affected","versionType":"git"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"5bb10753d428aadfc356a2bfe9acea09c82a62ec","status":"affected","versionType":"git"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"b06b6fce6d7deaf7238e09b48ce3b1125ff41acd","status":"affected","versionType":"git"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"03390aa32e669cc4ecd7d34108e2e1afc13d689d","status":"affected","versionType":"git"},{"version":"d9fb8cc230b2a4757e9fe4f81468f81212d4deaa","status":"affected","versionType":"git"},{"version":"6190cce26e40bf71c4d375b21eea74bb07b6a0f3","status":"affected","versionType":"git"},{"version":"01a658c1b9d4b5393c38d5a92d9112ab1425382a","status":"affected","versionType":"git"},{"version":"8809ae6747e760e6f1d2453ceb08c9bcc4939766","status":"affected","versionType":"git"},{"version":"4.4.133","lessThan":"4.5","status":"affected","versionType":"semver"},{"version":"4.9.103","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.44","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.16.12","lessThan":"4.17","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/netdevice.h","net/packet/af_packet.c"],"versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","status":"unaffected","versionType":"semver"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.6.152"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.12.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.133"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"},{"url":"https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"},{"url":"https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"},{"url":"https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"},{"url":"https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"}],"title":"packet: use consistent hard_header_len in non-ring send paths","x_generator":{"engine":"bippy-1.2.0"}}}}