Executive brief
A race condition vulnerability exists in the Linux kernel's packet socket subsystem, which is responsible for low-level network traffic handling. An attacker with basic local access can exploit this flaw to gain full administrative control (root privileges) over the system or escape from a container. This vulnerability is particularly significant because it has existed in the kernel for nearly 20 years and affects a wide range of Linux distributions.
Technical details
A race condition exists between packet_set_ring() and packet_notifier() in net/packet/af_packet.c. When packet_set_ring() temporarily releases the po->bind_lock, a concurrent NETDEV_UP event processed by packet_notifier() can register a protocol hook for a socket that is in an inconsistent state. This leads to a use-after-free (UAF) vulnerability when tpacket_rcv() accesses memory that has been freed or reallocated. An unprivileged local attacker with CAP_NET_RAW (often obtainable via user namespaces) can exploit this to corrupt kernel memory, bypass KASLR, and achieve arbitrary code execution. The fix involves ensuring the socket remains unhooked by setting po->num to zero while the lock is released.
Affected products
- Linux Linux Kernel 2.6.12 through 6.15
Timeline
- 2025-08-01: patched: Initial patch submitted by Quang Le
- 2025-08-22: disclosed: CVE published
- 2026-03-03: other: Detailed exploit write-up published by Calif
References
- https://blog.calif.io/p/a-race-within-a-race-exploiting-cve
- https://git.kernel.org/stable/c/01d3c8417b9c1b884a8a981a3b886da556512f36
- https://git.kernel.org/stable/c/18f13f2a83eb81be349a9757ba2141ff1da9ad73
- https://git.kernel.org/stable/c/7da733f117533e9b2ebbd530a22ae4028713955c
- https://git.kernel.org/stable/c/7de07705007c7e34995a5599aaab1d23e762d7ca
- https://git.kernel.org/stable/c/88caf46db8239e6471413d28aabaa6b8bd552805
- https://git.kernel.org/stable/c/ba2257034755ae773722f15f4c3ad1dcdad15ca9