Race condition in Linux kernel - CVE-2026-74666

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in packet_set_ring() and pressure clearing logic in af_packet when reconfiguring the ring while packet_poll() or packet_recvmsg() accesses receive state. A local user can reconfigure the packet socket ring and trigger packet polling or receive operations to cause a denial of service.

The issue can cause __packet_rcv_has_room() to dereference stale or NULL ring storage.

Affected software

How to mitigate CVE-2026-74666

External References

• https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000
• https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747
• https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb
• https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba
• https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62

Related Security Bulletins

• Race condition in Linux kernel packet
• Debian update for linux