CVE-2026-74667

Received Received - Intake

Memory Corruption in Linux Kernel Packet Socket

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here. For frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c ("macsec: do not read an unset MAC header in macsec_encrypt()"). packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too. Found by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74667

EUVD

EUVD-2026-64354

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing reset of the MAC header in packet-socket transmit paths. When sending frames via certain paths like PACKET_QDISC_BYPASS, the MAC header remains unset, leading to potential out-of-bounds memory access in drivers that read the MAC header during transmission.

Detection Guidance

This vulnerability is specific to the Linux kernel's packet-socket transmit path and may not have direct detection commands. Focus on monitoring for kernel crashes or unusual network driver behavior, especially when using PACKET_QDISC_BYPASS mode. Check kernel logs for out-of-bounds access errors or driver-specific issues.

Impact Analysis

This vulnerability could allow attackers to trigger memory corruption or crashes in the Linux kernel by sending specially crafted packets. Systems using vulnerable drivers that read the MAC header may experience instability or security breaches.

Compliance Impact

This vulnerability involves an out-of-bounds memory access in the Linux kernel's packet-socket transmit path, which could lead to undefined behavior or crashes. While it does not directly impact data confidentiality or integrity, such low-level kernel issues may affect system stability and reliability. Compliance standards like GDPR and HIPAA require secure and stable systems to protect data, so vulnerabilities that risk system crashes or instability could indirectly impact compliance by compromising the availability of systems handling sensitive data.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using PACKET_QDISC_BYPASS mode if possible. Monitor network drivers for compatibility issues after updating.

Hi! I’m here to help you understand CVE-2026-74667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70