CVE-2026-74582
packet: use consistent hard_header_len in non-ring send paths
Description
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
INFO
Published Date :
Aug. 21, 2026, 5:16 p.m.
Last Modified :
Aug. 21, 2026, 5:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74582
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the Linux kernel patch.
- Update the kernel to a fixed version.
- Ensure consistent header length usage.
- Use LL_RESERVED_SPACE_EX for saved header length.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74582.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74582 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74582
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74582 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74582 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 21, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba', 'lessThan': '91f041451f967cd87ed722a8f43c0b767a64f1a0', 'versionType': 'git'}, {'status': 'affected', 'version': 'b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba', 'lessThan': '9052756290962ffb9a661bcf319e92dedaaedfed', 'versionType': 'git'}, {'status': 'affected', 'version': 'b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba', 'lessThan': '5bb10753d428aadfc356a2bfe9acea09c82a62ec', 'versionType': 'git'}, {'status': 'affected', 'version': 'b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba', 'lessThan': 'b06b6fce6d7deaf7238e09b48ce3b1125ff41acd', 'versionType': 'git'}, {'status': 'affected', 'version': 'b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba', 'lessThan': '03390aa32e669cc4ecd7d34108e2e1afc13d689d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd9fb8cc230b2a4757e9fe4f81468f81212d4deaa', 'versionType': 'git'}, {'status': 'affected', 'version': '6190cce26e40bf71c4d375b21eea74bb07b6a0f3', 'versionType': 'git'}, {'status': 'affected', 'version': '01a658c1b9d4b5393c38d5a92d9112ab1425382a', 'versionType': 'git'}, {'status': 'affected', 'version': '8809ae6747e760e6f1d2453ceb08c9bcc4939766', 'versionType': 'git'}, {'status': 'affected', 'version': '4.4.133', 'lessThan': '4.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.9.103', 'lessThan': '4.10', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.14.44', 'lessThan': '4.15', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.16.12', 'lessThan': '4.17', 'versionType': 'semver'}], 'programFiles': ['include/linux/netdevice.h', 'net/packet/af_packet.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/linux/netdevice.h', 'net/packet/af_packet.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here. Added Reference https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d Added Reference https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec Added Reference https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed Added Reference https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0 Added Reference https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd