CVE-2026-74668

packet: use consistent hard_header_len in TX_RING send path

State: Published
Severity: 7.8 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in TX_RING send path

tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.

Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().

The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 9c7e8ff48c377bef18c3d178748aea0575b69edeAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 2a73b2c37ee3060a880b53cd24783d93fc7be5f8Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before d85d2fd54e901637c81d847811e03c662aee13cdAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 016763e829cac37b3234eace86fd0a4c560de4a7Affected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 27e068d1b35dbec10a3cf268887c94407be4badcAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before d48ea5c9c4c34dc0df621f0e39ed3a16b644621aAffected 69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 21b5953e7494c16a42e6cd8cf110e18d13ae4a6bAffected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 9c7e8ff48c377bef18c3d178748aea0575b69edeAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 2a73b2c37ee3060a880b53cd24783d93fc7be5f8Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before d85d2fd54e901637c81d847811e03c662aee13cdAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 016763e829cac37b3234eace86fd0a4c560de4a7Affected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 27e068d1b35dbec10a3cf268887c94407be4badcAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before d48ea5c9c4c34dc0df621f0e39ed3a16b644621aAffected
69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1 to before 21b5953e7494c16a42e6cd8cf110e18d13ae4a6bAffected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.