Executive brief
The Linux kernel's network packet validation function contains an out-of-bounds write vulnerability when handling raw network sockets with elevated privileges. An attacker with CAP_SYS_RAWIO capability can trigger memory corruption by sending specially crafted packets while the network device configuration is being modified, potentially leading to kernel crashes or data corruption.
Technical details
The vulnerability exists in dev_validate_header() which zero-pads short link layer headers for CAP_SYS_RAWIO-capable processes. When a device's hard_header_len increases between the initial buffer allocation and the validation phase, the memset operation writes past the reserved headroom buffer, causing an out-of-bounds write. The issue affects variable-length L2 protocols where len < hard_header_len. The fix removes the CAP_SYS_RAWIO zero-padding branch entirely, as the bypass has no legitimate use beyond testing malformed input. Attack requires CAP_SYS_RAWIO privilege and concurrent device reconfiguration.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-03: disclosed