Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74582— packet: use consistent hard_header_len in non-ring send paths

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： packet: 在非环形发送路径中使用一致的 hard_header_len 在分配和构造 （套接字缓冲区）时会多次读取 。设备配置的重构可能会并发地改变该值，例如通过 bonding 设备的类型变更。 对于 类型的套接字， 可能在 中保存一个较大的值，随后使用较小的值来分配头空间（headroom）。将 向后移动 大小的距离后，可能导致其位于 之前，此时从用户空间进行的后续拷贝操作可能尝试执行越界写入。 也存在相同的问题，因为它在释放 RCU 读锁以分配 之前，从多次独立

CVSS 7.8 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 91f041451f967cd87ed722a8f43c0b767a64f1a0 affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 9052756290962ffb9a661bcf319e92dedaaedfed affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 5bb10753d428aadfc356a2bfe9acea09c82a62ec affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< b06b6fce6d7deaf7238e09b48ce3b1125ff41acd affected
b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba< 03390aa32e669cc4ecd7d34108e2e1afc13d689d affected
d9fb8cc230b2a4757e9fe4f81468f81212d4deaa affected
6190cce26e40bf71c4d375b21eea74bb07b6a0f3 affected
01a658c1b9d4b5393c38d5a92d9112ab1425382a affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74582

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
packet: use consistent hard_header_len in non-ring send paths
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba ~ 91f041451f967cd87ed722a8f43c0b767a64f1a0 -
Linux Linux 4.17 -

II. Public POCs for CVE-2026-74582

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74582

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74582 (5)

Same Patch Batch · Linux · 2026-08-21 · 4 CVEs total

CVE-2026-74581 9.8 CRITICAL net: ipv6: clear suppressed fib6 rule result
CVE-2026-74580 8.8 HIGH vhost: reset the vring metadata cache on vring reconfiguration
CVE-2026-74583 7.8 HIGH net/sched: cls_route: fix fastmap use-after-free on filter

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74582

No comments yet

Leave a comment