CVE-2026-74667

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: reset the MAC header on the packet-socket transmit path

packet_parse_headers() resets the MAC header only for a SOCK_RAW frame

whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,

any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave

skb->mac_header unset here.

For frames sent via __dev_queue_xmit() this is harmless: it resets the

MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS

path uses dev_direct_xmit(), which does not, so the frame reaches

ndo_start_xmit() with the MAC header unset. A driver that reads

eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an

out-of-bounds access ~64 KiB past the head -- the same class fixed for

one consumer in commit f5089008f90c ("macsec: do not read an unset MAC

header in macsec_encrypt()").

packet_parse_headers() runs only on the transmit path, where skb->data

points at the start of the L2 header f

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References