Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74582— packet: use consistent hard_header_len in non-ring send paths

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.17版本存在安全漏洞，该漏洞源于packet_snd()和packet_sendmsg_spkt()多次读取dev->hard_header_len，设备重配置可并发改变该值，导致缓冲区预留与分配不一致，可能造成越界写入。

CVSS 7.8 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 26

VendorProduct Version RangeStatus
Linux Linux b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812 affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 78a47127e33c340bc6d38dcc4552a094b4f5cc77 affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 142e287b3a25cfe909215177c23243e7fc5ae2b1 affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 91f041451f967cd87ed722a8f43c0b767a64f1a0 affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 9052756290962ffb9a661bcf319e92dedaaedfed affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 5bb10753d428aadfc356a2bfe9acea09c82a62ec affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< b06b6fce6d7deaf7238e09b48ce3b1125ff41acd affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 03390aa32e669cc4ecd7d34108e2e1afc13d689d affected
… +18 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74582

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
packet: use consistent hard_header_len in non-ring send paths
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.17版本存在安全漏洞，该漏洞源于packet_snd()和packet_sendmsg_spkt()多次读取dev->hard_header_len，设备重配置可并发改变该值，导致缓冲区预留与分配不一致，可能造成越界写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba ~ bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812 -
Linux Linux 4.17 -

II. Public POCs for CVE-2026-74582

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74582

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74582 (5)

Other References for CVE-2026-74582 (3)

Same Patch Batch · Linux · 2026-08-21 · 4 CVEs total

CVE-2026-74581 9.8 CRITICAL net: ipv6: clear suppressed fib6 rule result
CVE-2026-74580 8.8 HIGH vhost: reset the vring metadata cache on vring reconfiguration
CVE-2026-74583 7.8 HIGH net/sched: cls_route: fix fastmap use-after-free on filter

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74582

No comments yet

Leave a comment