Executive brief
The Linux kernel's packet socket implementation (AF_PACKET) contains a race condition in the TX_RING transmission path where concurrent network device reconfigurations can cause the reserved buffer space to become inconsistent with actual header sizes. An attacker with local access can exploit this to trigger buffer overflows or kernel memory corruption when sending packets through packet sockets, potentially leading to denial of service or privilege escalation.
Technical details
The vulnerability is a time-of-check-to-time-of-use (TOCTOU) race in the tpacket_snd() function within net/packet/af_packet.c. The function reads dev->hard_header_len at multiple points without synchronization, allowing concurrent netdevice reconfiguration to change this value between the buffer allocation phase and the actual packet construction phase in tpacket_fill_skb(). This can result in either reserved headroom becoming smaller than the amount pushed to the buffer, or copylen - hard_header_len becoming negative. The fix snapshots hard_header_len once using READ_ONCE() at the start of processing and passes it consistently through all subsequent operations. Exploitation requires local access to create and manipulate packet sockets, with the ability to trigger network device reconfiguration concurrently.
Affected products
- Linux Linux kernel 2.6.11 and later (fixed in various LTS branches, see kernel commit 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b)
Timeline
- 2026-08-22: disclosed: CVE published and NVD entry created
- 2026-08-06: patched: Upstream kernel fix merged (commit 21b5953e7494c16a42e6cd8cf110e18d13ae4a6b)
- 2026-08-19: patched: Stable kernel release with fix (commit 016763e829cac37b3234eace86fd0a4c560de4a7)