CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths

Published Aug 21, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hardheaderlen in non-ring send paths

packetsnd() reads dev->hardheaderlen multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes.

For SOCKRAW, packetsnd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write.

packetsendmsgspkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb.

Add LLRESERVEDSPACEEX() for callers that already saved a header length. Read hardheaderlen once in packetsnd() and use it for allocation and construction. In packetsendmsgspkt(), preserve the allocation-time value through the device lookup retry.

The separate SOCKDGRAM consistency problem between hardheaderlen and headerops->create is not addressed here.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 21, 2026
CVE Published
via MITRE·04:31 PM
Data Sourced
via MITRE·04:31 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the out-of-bounds write?

An attacker needs to use affected non-ring packet socket send paths while the target network device's hard_header_len changes concurrently. The described trigger includes device reconfiguration such as bonding device type changes, and the explicit out-of-bounds write scenario applies to SOCK_RAW.

2

Which packet socket paths are affected?

The issue is described in packet_snd() and packet_sendmsg_spkt(), which can derive reservation or header values from inconsistent reads of dev->hard_header_len. Ring-based send paths are not identified as affected.

3

Does this fix address all hard_header_len consistency issues for packet sockets?

No. The described fix does not address the separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203