Vulnerability-Lookup

CVE-2026-74582 (GCVE-0-2026-74582)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40

Title

packet: use consistent hard_header_len in non-ring send paths

Summary

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/91f041451f967cd87…
https://git.kernel.org/stable/c/9052756290962ffb9…
https://git.kernel.org/stable/c/5bb10753d428aadfc…
https://git.kernel.org/stable/c/b06b6fce6d7deaf72…
https://git.kernel.org/stable/c/03390aa32e669cc4e…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 91f041451f967cd87ed722a8f43c0b767a64f1a0 (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 9052756290962ffb9a661bcf319e92dedaaedfed (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 5bb10753d428aadfc356a2bfe9acea09c82a62ec (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd (git) Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 03390aa32e669cc4ecd7d34108e2e1afc13d689d (git) Affected: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa (git) Affected: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 (git) Affected: 01a658c1b9d4b5393c38d5a92d9112ab1425382a (git) Affected: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 (git) Affected: 4.4.133 , < 4.5 (semver) Affected: 4.9.103 , < 4.10 (semver) Affected: 4.14.44 , < 4.15 (semver) Affected: 4.16.12 , < 4.17 (semver)	guessed
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.133",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.133",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:08.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
        },
        {
          "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
        }
      ],
      "title": "packet: use consistent hard_header_len in non-ring send paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74582",
    "datePublished": "2026-08-21T16:31:55.283Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:08.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74582",
      "date": "2026-08-24",
      "epss": "0.00156",
      "percentile": "0.04997"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:43:55.000Z",
      "cve": "CVE-2026-74582",
      "id": "msrc_CVE-2026-74582",
      "initial_release_date": "2026-08-23T01:03:14.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "packet: use consistent hard_header_len in non-ring send paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74582.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74582\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-21T17:16:44.507\",\"lastModified\":\"2026-08-25T06:18:31.747\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npacket: use consistent hard_header_len in non-ring send paths\\n\\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\\nand constructing an skb. Device reconfiguration can change this value\\nconcurrently, for example through bonding device type changes.\\n\\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\\nthen places it before skb-\u003ehead, and the following copy from userspace can\\nattempt an out-of-bounds write.\\n\\npacket_sendmsg_spkt() has the same issue because it calculates its\\nreservation and header offset from separate reads before dropping the RCU\\nread lock to allocate the skb.\\n\\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\\nRead hard_header_len once in packet_snd() and use it for allocation and\\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\\nthrough the device lookup retry.\\n\\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\\nheader_ops-\u003ecreate is not addressed here.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/netdevice.h\",\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba\",\"lessThan\":\"91f041451f967cd87ed722a8f43c0b767a64f1a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba\",\"lessThan\":\"9052756290962ffb9a661bcf319e92dedaaedfed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba\",\"lessThan\":\"5bb10753d428aadfc356a2bfe9acea09c82a62ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba\",\"lessThan\":\"b06b6fce6d7deaf7238e09b48ce3b1125ff41acd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba\",\"lessThan\":\"03390aa32e669cc4ecd7d34108e2e1afc13d689d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d9fb8cc230b2a4757e9fe4f81468f81212d4deaa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6190cce26e40bf71c4d375b21eea74bb07b6a0f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01a658c1b9d4b5393c38d5a92d9112ab1425382a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8809ae6747e760e6f1d2453ceb08c9bcc4939766\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.133\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.103\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.44\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.16.12\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/netdevice.h\",\"net/packet/af_packet.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-25T06:02:35+00:00",
      "cve": "CVE-2026-74582",
      "id": "CVE-2026-74582",
      "initial_release_date": "2026-08-21T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: packet: use consistent hard_header_len in non-ring send paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-22T16:28:21Z",
      "cve": "CVE-2026-74582",
      "id": "CVE-2026-74582",
      "initial_release_date": "2026-08-22T00:52:33Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74582",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74582.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-74582

Vulnerability from fkie_nvd - Published: 2026-08-21 17:16 - Updated: 2026-08-25 06:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.133",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
    }
  ],
  "id": "CVE-2026-74582",
  "lastModified": "2026-08-25T06:18:31.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-21T17:16:44.507",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-6G47-HQW2-HV2R

Vulnerability from github – Published: 2026-08-21 18:34 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths

packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes.

For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write.

packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb.

Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry.

The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74582"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T17:16:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here.",
  "id": "GHSA-6g47-hqw2-hv2r",
  "modified": "2026-08-25T06:31:21Z",
  "published": "2026-08-21T18:34:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74582"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74582

Vulnerability from csaf_microsoft - Published: 2026-08-23 01:03 - Updated: 2026-08-24 14:43

Summary

packet: use consistent hard_header_len in non-ring send paths

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74582

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74582 packet: use consistent hard_header_len in non-ring send paths - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74582.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "packet: use consistent hard_header_len in non-ring send paths",
    "tracking": {
      "current_release_date": "2026-08-24T14:43:55.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.239Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74582",
      "initial_release_date": "2026-08-23T01:03:14.000Z",
      "revision_history": [
        {
          "date": "2026-08-23T01:03:14.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:43:55.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74582",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74582 packet: use consistent hard_header_len in non-ring send paths - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74582.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-23T01:03:14.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "packet: use consistent hard_header_len in non-ring send paths"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74582 (GCVE-0-2026-74582)

FKIE_CVE-2026-74582

GHSA-6G47-HQW2-HV2R

MSRC_CVE-2026-74582

Tags

Sightings

Nomenclature