GHSA-J5CF-5XP4-R57F

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-27 15:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in TX_RING send path

tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.

Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().

The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-74668"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:40Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in TX_RING send path\n\ntpacket_snd() reads dev-\u003ehard_header_len independently for skb\nallocation and header construction in tpacket_fill_skb(). Concurrent\nnetdevice reconfiguration can therefore make the reserved headroom\nsmaller than the amount later pushed, or make copylen - hard_header_len\nnegative.\n\nSnapshot hard_header_len once before processing ring frames and use it\nfor the frame limit, headroom allocation, copy length, and skb\nconstruction. Pass the snapshot to tpacket_fill_skb().\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here.",
  "id": "GHSA-j5cf-5xp4-r57f",
  "modified": "2026-08-27T15:31:31Z",
  "published": "2026-08-22T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74668"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2a73b2c37ee3060a880b53cd24783d93fc7be5f8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c7e8ff48c377bef18c3d178748aea0575b69ede"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.