CVE-2026-68338

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: avoid fanout hook re-registration after unregister

packet_set_ring() temporarily detaches a socket from packet delivery while

reconfiguring its ring. It records the previous running state, clears

po->num, unregisters the protocol hook when needed, drops po->bind_lock,

and later restores po->num and re-registers the hook from the saved

was_running value.

That unlocked window can race with NETDEV_UNREGISTER. The notifier can

observe the socket as not running, skip __unregister_prot_hook(), and

invalidate the per-socket binding by setting po->ifindex to -1 and clearing

po->prot_hook.dev. A one-member fanout group can still retain its shared

fanout hook device pointer. When packet_set_ring() resumes, re-registering

solely from the stale was_running state can re-add the fanout hook after

the device has been unregistered.

Treat po->ifindex == -1 as an invalidated binding after reacquiring

po->bind_lock. This

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References