CVE-2026-74668
Description
A flaw was found in the Linux kernel's packet handling mechanism. During concurrent network device reconfigurations, an inconsistency in how the hard_header_len value is used can lead to memory corruption. This issue could allow an attacker to cause a denial of service by triggering a system crash or potentially lead to other unpredictable system behavior.
Statement
AF_PACKET TX_RING send can use inconsistent hard_header_len values when tpacket_snd() races with netdevice reconfiguration. The skb may be allocated with smaller reserved headroom than the amount later pushed in tpacket_fill_skb(), or copylen minus hard_header_len may become negative, which can trigger skb bounds checks and a kernel crash. For the CVSS the PR:L is used in the paranoid score because reduced capability root, container root, or delegated CAP_NET_RAW and CAP_NET_ADMIN access may be enough to reach the packet socket and reconfiguration path. The issue is local and is not directly network reachable. Impact is at least denial of service.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
