Out-of-bounds write in Linux kernel - CVE-2026-74582

Vulnerability details

The vulnerability allows a local user to cause an out-of-bounds write.

The vulnerability exists due to an out-of-bounds write in packet_snd() and packet_sendmsg_spkt() in the Linux kernel AF_PACKET implementation when handling non-ring send paths during concurrent device reconfiguration. A local user can send crafted packets while triggering a change in hard_header_len to cause an out-of-bounds write.

The issue affects SOCK_RAW send handling, and packet_sendmsg_spkt() is affected by the same inconsistent header length usage across allocation and packet construction.

Affected software

How to mitigate CVE-2026-74582

External References

• https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d
• https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec
• https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed
• https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0
• https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd

Related Security Bulletins

• Out-of-bounds write in Linux kernel packet
• Debian update for linux