CVE-2026-74668packet: use consistent hard_header_len in TX_RING send path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in TX_RING send path tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative. Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb(). The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 builds before 9c7e8ff48c377bef18c3d178748aea0575b69ede; 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 builds before 2a73b2c37ee3060a880b53cd24783d93fc7be5f8; from 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 before e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2; from 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 before d85d2fd54e901637c81d847811e03c662aee13cd; from 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 before 016763e829cac37b3234eace86fd0a4c560de4a7; 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 builds before 27e068d1b35dbec10a3cf268887c94407be4badc; from 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 before d48ea5c9c4c34dc0df621f0e39ed3a16b644621a; 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 builds before 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b | CNA record |
References
- https://git.kernel.org/stable/c/9c7e8ff48c377bef18c3d178748aea0575b69ede
- https://git.kernel.org/stable/c/2a73b2c37ee3060a880b53cd24783d93fc7be5f8
- https://git.kernel.org/stable/c/e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2
- https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd
- https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7
- https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc
- https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a
- https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.