CVE-2026-74668

The packet transmission path in the Linux kernel reads the device’s hard_header_len value twice – once during socket buffer allocation and again when building the packet header in tpacket_fill_skb(). If a network device is reconfigured between these reads, the allocated headroom may become smaller than the space that will be copied, or the copy length can become negative. This misalignment can result in an out‑of‑bounds write, corrupting kernel memory (buffer overrun, CWE-131) or causing a kernel crash. The flaw exists in the packet.c source handling tpacket_snd() and affects any Linux kernel version that includes the buggy TX_RING send path.

All Linux kernel releases that have not yet incorporated the hard_header_len snapshot fix, including kernel versions before the commit series starting with 016763e829cac37b3234eace86fd0a4c560de4a7. The affected systems are Linux servers, clients, and embedded devices that rely on packet sockets and TX_RING for high‑throughput packet handling.

The EPSS score < 1% and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw allows a potential remote attacker to trigger an out‑of‑bounds write by sending packets while an adversary can alter the network device configuration, thereby creating a race condition. The CVSS score 7.8 characterizes this as a high‑severity vulnerability. The impact could be kernel memory corruption, unauthorized privilege escalation, or denial of service. Given that the kernel is a privilege level boundary, successful exploitation could compromise entire systems, although the exact likelihood and ease of exploitation remain uncertain without further exploitation research. The likely attack vector is inferred to be remote packet injection, where the attacker can adjust network device configuration before sending crafted packets.