Executive brief
The Linux kernel's packet socket implementation does not properly initialize a memory pointer (MAC header) before transmitting certain network frames. When a network driver reads this uninitialized pointer, it can access memory ~64 KB past the intended location, potentially causing a kernel crash or data exposure. This affects systems using packet sockets for direct network transmission.
Technical details
The vulnerability is an out-of-bounds memory access (CWE-416/CWE-119) in the Linux kernel's packet socket transmit path. The root cause is that packet_parse_headers() does not unconditionally reset skb->mac_header on all code paths; specifically, protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and the legacy SOCK_PACKET path leave this pointer uninitialized. When the PACKET_QDISC_BYPASS path calls dev_direct_xmit() (rather than __dev_queue_xmit()), the frame reaches ndo_start_xmit() with an invalid MAC header, and any driver reading eth_hdr(skb) will dereference skb->head + (u16)~0, accessing memory approximately 64 KB past the buffer start. The attack requires the ability to send packets via packet sockets (typically local/root privilege). The fix unconditionally resets the MAC header in packet_parse_headers() on the transmit path for all socket types. Patches have been committed upstream and to stable kernel trees.
Affected products
- Linux Linux kernel all versions prior to patch c2707480cfbf19c7619acc9c089d17f20869821f
Timeline
- 2026-08-22: disclosed: CVE-2026-74667 published
- 2026-07-24: patched: Upstream patch c2707480cfbf19c7619acc9c089d17f20869821f committed
- 2026-08-19: patched: Backported to stable kernel trees