Executive brief
The Linux kernel's packet socket implementation had a synchronization bug in the AF_PACKET subsystem that allows concurrent access to ring buffers during reconfiguration. Attackers could exploit this race condition to trigger memory access violations, leading to kernel crashes or denial of service on any system running a vulnerable kernel version.
Technical details
A race condition exists in the packet socket ring buffer reconfiguration code (net/packet/af_packet.c). When packet_set_ring() reconfigures RX ring state, it released sk_receive_queue.lock before updating the receive hook function pointer (po->prot_hook.func). This allowed concurrent calls to packet_poll() and packet_recvmsg() to execute the pressure-clearing code path after the ring was cleared but while tpacket_rcv was still visible, causing __packet_rcv_has_room() to dereference stale or NULL ring storage. The fix synchronizes hook assignment within the lock and serializes pressure-clearing operations with proper locking. The vulnerability is reachable by local users with socket access permissions on systems with AF_PACKET support enabled.
Affected products
- Linux Linux kernel All versions before the fix (commit 1a35da325cac4d5bcad76a2aa943408a6f1d9000)
Timeline
- 2026-08-22: disclosed: CVE-2026-74666 published
- 2026-07-29: patched: Patch committed to kernel by Zihan Xi
- 2026-08-04: other: Patch merged by Paolo Abeni