{"id":"CVE-2026-74582","title":"In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev->hard_header_len multiple times while allocating\nand constructing an skb","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev->hard_header_len multiple times while allocating\nand constructing an skb. Device r…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 78a47127e33c340bc6d38dcc4552a094b4f5cc77","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 142e287b3a25cfe909215177c23243e7fc5ae2b1","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 91f041451f967cd87ed722a8f43c0b767a64f1a0","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 9052756290962ffb9a661bcf319e92dedaaedfed","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 5bb10753d428aadfc356a2bfe9acea09c82a62ec","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd","Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 03390aa32e669cc4ecd7d34108e2e1afc13d689d","Linux d9fb8cc230b2a4757e9fe4f81468f81212d4deaa","Linux 6190cce26e40bf71c4d375b21eea74bb07b6a0f3","Linux 01a658c1b9d4b5393c38d5a92d9112ab1425382a","Linux 8809ae6747e760e6f1d2453ceb08c9bcc4939766","Linux >= 4.4.133 < 4.5","Linux >= 4.9.103 < 4.10","Linux >= 4.14.44 < 4.15","Linux >= 4.16.12 < 4.17","Linux 4.17"],"patched":["enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_e4s_v_9_2","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_6","enterprise_linux_real_time_for_nfv_eus_v_10_0","enterprise_linux_nfv_v_8","enterprise_linux_real_time_for_nfv_e4s_v_9_2","enterprise_linux_real_time_for_nfv_e4s_v_9_4","enterprise_linux_real_time_for_nfv_eus_v_9_6","enterprise_linux_real_time_eus_v_10_0","enterprise_linux_rt_v_8","enterprise_linux_real_time_e4s_v_9_2","enterprise_linux_real_time_e4s_v_9_4","enterprise_linux_real_time_eus_v_9_6"],"published":"2026-08-21","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:40.100","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74582","references":[{"url":"https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-74582"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519475"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74582"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74582"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:62609"},{"url":"https://access.redhat.com/errata/RHSA-2026:67723"},{"url":"https://access.redhat.com/errata/RHSA-2026:60484"},{"url":"https://access.redhat.com/errata/RHSA-2026:60486"},{"url":"https://access.redhat.com/errata/RHSA-2026:77498"},{"url":"https://access.redhat.com/errata/RHSA-2026:65710"},{"url":"https://access.redhat.com/errata/RHSA-2026:65711"},{"url":"https://access.redhat.com/errata/RHSA-2026:63537"},{"url":"https://access.redhat.com/errata/RHSA-2026:77500"},{"url":"https://access.redhat.com/errata/RHSA-2026:67721"},{"url":"https://access.redhat.com/errata/RHSA-2026:76738"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0012,"epssPercentile":0.01841,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:01:14.406882Z"},"ingestedAt":"2026-10-14T19:49:57.560Z","slug":"CVE-2026-74582","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev->hard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb->data back by reserve\nthen places it before skb->head, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops->create is not addressed here.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:62609** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62609)\n- **RHSA-2026:67723** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67723)\n- **RHSA-2026:60484** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60484)\n- **RHSA-2026:60486** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60486)\n- **RHSA-2026:77498** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77498)\n- **RHSA-2026:65710** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65710)\n- **RHSA-2026:65711** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65711)\n- **RHSA-2026:63537** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63537)\n- **RHSA-2026:77500** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:77500)\n- **RHSA-2026:67721** · Red Hat · fixed in: Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2), Red Hat Enterprise Linux Real Time E4S (v.9.2) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67721)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json)\n- **RHSA-2026:76738** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76738)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}