Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74668

packet: use consistent hard_header_len in TX_RING send path

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.267, 5.15.218, 6.1.185, 6.6.152, 6.12.104, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in TX_RING send path tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative. Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb(). The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in 9c7e8ff48c377bef18c3d178748aea0575b69ede; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in 2a73b2c37ee3060a880b53cd24783d93fc7be5f8; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in d85d2fd54e901637c81d847811e03c662aee13cd; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in 016763e829cac37b3234eace86fd0a4c560de4a7; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in 27e068d1b35dbec10a3cf268887c94407be4badc; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in d48ea5c9c4c34dc0df621f0e39ed3a16b644621a; From 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 · fixed in 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b

  • Linux Linux

    2.6.31

  • KernelLinux

    From 2.6.31 · fixed in 5.10.267; From 5.11.0 · fixed in 5.15.218; From 5.16.0 · fixed in 6.1.185; From 6.2.0 · fixed in 6.6.152; From 6.7.0 · fixed in 6.12.104; From 6.13.0 · fixed in 6.18.45; From 6.19.0 · fixed in 7.1.9

References 8

git.kernel.org