CVE-2026-74667

net/packet: reset the MAC header on the packet-socket transmit path

Published Aug 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: reset the MAC header on the packet-socket transmit path

packet_parse_headers() resets the MAC header only for a SOCK_RAW frame
whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,
any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave
skb->mac_header unset here.

For frames sent via __dev_queue_xmit() this is harmless: it resets the
MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS
path uses dev_direct_xmit(), which does not, so the frame reaches
ndo_start_xmit() with the MAC header unset. A driver that reads
eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an
out-of-bounds access ~64 KiB past the head -- the same class fixed for
one consumer in commit f5089008f90c ("macsec: do not read an unset MAC
header in macsec_encrypt()").

packet_parse_headers() runs only on the transmit path, where skb->data
points at the start of the L2 header for every packet-socket type
regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied
header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC
header unconditionally, mirroring __dev_queue_xmit(), so the frame is
anchored on the bypass path too.

Found by 0sec (https://0sec.ai) using automated source analysis;
verified against source and matched to the macsec KASAN report in
f5089008f90c. Compile-tested.

Analysis

Technical impact

The vulnerability resides in the Linux kernel’s packet‑socket transmit path. When a driver accesses the MAC header during transmit, skb->mac_header may be unset, causing an out‑of‑bounds read roughly 64 KiB past the packet head. This read path can trigger a kernel fault, leading to a system crash or service interruption, effectively a denial of service.

Affected Systems

All Linux kernel variants that have not yet incorporated the commit which resets the MAC header on the packet‑socket transmit path are affected. No specific kernel version ranges are enumerated in the advisory, so any kernel released prior to that patch is potentially vulnerable.

Risk and Exploitability

The exploit requires a user or process that can create and transmit a protocol‑bound SOCK_RAW or SOCK_PACKET socket via the PACKET_QDISC_BYPASS path, typically limited to privileged or locally running processes with CAP_NET_RAW. No publicly available exploits are known. The CVSS score of 7.8 indicates a high likelihood of impact, while the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The attack is purely local, thus the risk is moderate for environments where untrusted users can create raw packet sockets or where custom network drivers lack checks for unset MAC headers.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< 1e43a1d66615f411d427f9df1f46dd049d9e3681
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< 4057853a91fb796c4f47c7d1baf1aa085394148e
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< 2610ed4e86a4590234a9d70518c469751c5af231
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< b47ba8fe6e1d2df8c92048de5afafd059447dc30
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< 284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< 971aa7d99242bbf09513e27b7a243f0b29ff23ae
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< fdd4d7d52358a58e351dd9d82530c04eba8ccd7a
`75c65772c3d18447d62d3aca5f91b06c16cc25e4`	affected	< c2707480cfbf19c7619acc9c089d17f20869821f

Linux

affected

Version	Status	Constraints
`5.1`	affected	—
`0`	unaffected	< 5.1
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,1e43a1d66615f411d427f9df1f46dd049d9e3681)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,4057853a91fb796c4f47c7d1baf1aa085394148e)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,2610ed4e86a4590234a9d70518c469751c5af231)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,b47ba8fe6e1d2df8c92048de5afafd059447dc30)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,971aa7d99242bbf09513e27b7a243f0b29ff23ae)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,fdd4d7d52358a58e351dd9d82530c04eba8ccd7a)`	affected	code_commit	—
`[75c65772c3d18447d62d3aca5f91b06c16cc25e4,c2707480cfbf19c7619acc9c089d17f20869821f)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.1`	affected	generic	—
`[0,5.1)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that contains the commit resetting the MAC header on the packet‑socket transmit path.
Ensure custom network drivers check whether skb->mac_header is set before calling eth_hdr(skb) on transmit.
Restrict the ability to create raw packet sockets by tightening kernel capabilities or using set‑capability controls.

Generated by OpenCVE AI on August 25, 2026 at 13:58 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.136% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681
https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231
https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d
https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e
https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae
https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30
https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f
https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a
https://lore.kernel.org/linux-cve-announce/2026082229-CVE-2026-74667-8fdf@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74667
https://www.cve.org/CVERecord?id=CVE-2026-74667

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026082229-CVE-2026-74667-8fdf@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74667 https://www.cve.org/CVERecord?id=CVE-2026-74667
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 8:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-805

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 7:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-805

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here. For frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c ("macsec: do not read an unset MAC header in macsec_encrypt()"). packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too. Found by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.
Title		net/packet: reset the MAC header on the packet-socket transmit path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681 https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231 https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30 https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a