Race condition in Linux kernel - CVE-2026-74668

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.

The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.

Affected software

How to mitigate CVE-2026-74668

External References

• https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7
• https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b
• https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc
• https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a
• https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd

Related Security Bulletins

• Race condition in Linux kernel packet
• Debian update for linux