Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T12:00:00 kernel: packet: use consistent hard_header_len in non-ring send paths 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

An out-of-bounds write problem was observed in packet_sendmsg_spkt in net/packet/af_packet.c in the Linux Kernel. In this flaw, AF_PACKET hard_header_len race may allow local privilege escalation.

Red Hat Enterprise Linux 10.0 Extended Update Support 2026-09-02T00:00:00Z RHSA-2026:62609 kernel-0:6.12.0-55.102.1.el10_0 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-09-09T00:00:00Z RHSA-2026:65710 kernel-0:4.18.0-305.206.1.el8_4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-09-09T00:00:00Z RHSA-2026:65710 kernel-0:4.18.0-305.206.1.el8_4 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-09-09T00:00:00Z RHSA-2026:65711 kernel-0:4.18.0-372.213.1.el8_6 Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-09-09T00:00:00Z RHSA-2026:65711 kernel-0:4.18.0-372.213.1.el8_6 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-09-04T00:00:00Z RHSA-2026:63537 kernel-0:4.18.0-477.165.1.el8_8 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-09-04T00:00:00Z RHSA-2026:63537 kernel-0:4.18.0-477.165.1.el8_8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-09-16T00:00:00Z RHSA-2026:67723 kernel-0:5.14.0-284.191.1.el9_2 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-09-16T00:00:00Z RHSA-2026:67721 kernel-rt-0:5.14.0-284.191.1.rt14.476.el9_2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-08-27T00:00:00Z RHSA-2026:60484 kernel-0:5.14.0-427.147.1.el9_4 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-27T00:00:00Z RHSA-2026:60486 kernel-0:5.14.0-570.136.1.el9_6 Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Will not fix kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt Red Hat Enterprise Linux for NVIDIA 26 Not affected kernel https://www.cve.org/CVERecord?id=CVE-2026-74582 https://nvd.nist.gov/vuln/detail/CVE-2026-74582 https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/T