CVE-2026-74582

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths

packet_snd() reads dev->hard_header_len multiple times while allocating

and constructing an skb. Device reconfiguration can change this value

concurrently, for example through bonding device type changes.

For SOCK_RAW, packet_snd() can save a larger value in reserve and later

allocate headroom using a smaller value. Moving skb->data back by reserve

then places it before skb->head, and the following copy from userspace can

attempt an out-of-bounds write.

packet_sendmsg_spkt() has the same issue because it calculates its

reservation and header offset from separate reads before dropping the RCU

read lock to allocate the skb.

Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.

Read hard_header_len once in packet_snd() and use it for allocation and

construction. In packet_sendmsg_spkt(), preserve the allocation-time value

through the d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References