--- id: CVE-2026-74582 title: |- In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb summary: |- In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device r… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-825 vendor: Linux product: Linux affected: - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812 - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 78a47127e33c340bc6d38dcc4552a094b4f5cc77 - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 142e287b3a25cfe909215177c23243e7fc5ae2b1 - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 91f041451f967cd87ed722a8f43c0b767a64f1a0 - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 9052756290962ffb9a661bcf319e92dedaaedfed - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 5bb10753d428aadfc356a2bfe9acea09c82a62ec - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd - >- Linux >= b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba < 03390aa32e669cc4ecd7d34108e2e1afc13d689d - Linux d9fb8cc230b2a4757e9fe4f81468f81212d4deaa - Linux 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 - Linux 01a658c1b9d4b5393c38d5a92d9112ab1425382a - Linux 8809ae6747e760e6f1d2453ceb08c9bcc4939766 - Linux >= 4.4.133 < 4.5 - Linux >= 4.9.103 < 4.10 - Linux >= 4.14.44 < 4.15 - Linux >= 4.16.12 < 4.17 - Linux 4.17 patched: - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_e4s_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_real_time_for_nfv_eus_v_10_0 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_e4s_v_9_2 - enterprise_linux_real_time_for_nfv_e4s_v_9_4 - enterprise_linux_real_time_for_nfv_eus_v_9_6 - enterprise_linux_real_time_eus_v_10_0 - enterprise_linux_rt_v_8 - enterprise_linux_real_time_e4s_v_9_2 - enterprise_linux_real_time_e4s_v_9_4 - enterprise_linux_real_time_eus_v_9_6 published: '2026-08-21' updated: '2026-10-16' sourceUpdated: '2026-10-16T20:17:40.100' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74582' references: - url: 'https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json - url: 'https://access.redhat.com/security/cve/CVE-2026-74582' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519475' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-74582' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74582' - url: >- https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:62609' - url: 'https://access.redhat.com/errata/RHSA-2026:67723' - url: 'https://access.redhat.com/errata/RHSA-2026:60484' - url: 'https://access.redhat.com/errata/RHSA-2026:60486' - url: 'https://access.redhat.com/errata/RHSA-2026:77498' - url: 'https://access.redhat.com/errata/RHSA-2026:65710' - url: 'https://access.redhat.com/errata/RHSA-2026:65711' - url: 'https://access.redhat.com/errata/RHSA-2026:63537' - url: 'https://access.redhat.com/errata/RHSA-2026:77500' - url: 'https://access.redhat.com/errata/RHSA-2026:67721' - url: 'https://access.redhat.com/errata/RHSA-2026:76738' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.0012 epssPercentile: 0.01841 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T19:01:14.406882Z' ingestedAt: '2026-10-14T19:49:57.560Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:62609** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62609) - **RHSA-2026:67723** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67723) - **RHSA-2026:60484** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60484) - **RHSA-2026:60486** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60486) - **RHSA-2026:77498** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77498) - **RHSA-2026:65710** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65710) - **RHSA-2026:65711** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65711) - **RHSA-2026:63537** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63537) - **RHSA-2026:77500** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:77500) - **RHSA-2026:67721** · Red Hat · fixed in: Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2), Red Hat Enterprise Linux Real Time E4S (v.9.2) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67721) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json) - **RHSA-2026:76738** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76738)