CVE-2026-74666

Received Received - Intake

Race Condition in Linux Kernel Packet Handling

Publication date: 2026-08-22

Last updated on: 2026-08-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage. Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix. Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again. packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-27

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74666

EUVD

EUVD-2026-64353

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where packet_set_ring() updates the RX ring state under a lock but publishes the receive mode after releasing the lock. This allows packet_poll() and packet_recvmsg() to run pressure clearing while still seeing stale ring data, potentially causing NULL pointer dereferences.

Detection Guidance

This vulnerability is specific to the Linux kernel's packet socket implementation and may not have direct detection commands. Monitor kernel logs for packet-related errors or crashes after ring reconfiguration. Check for kernel panic or oops messages related to packet sockets.

Impact Analysis

This could lead to kernel crashes or memory corruption if exploited, potentially causing system instability or denial of service. Local attackers with sufficient privileges might trigger this issue.

Compliance Impact

This vulnerability is a Linux kernel issue related to packet ring buffer management, which could lead to memory corruption or crashes. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is not a data privacy or security control failure. Compliance impacts would only occur if this vulnerability were exploited to cause system instability or unauthorized access, which is not described here.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using packet sockets in configurations that may trigger the race condition until patched.

Hi! I’m here to help you understand CVE-2026-74666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70