CVE-2026-74582: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74582 Overview

CVE-2026-74582 is a Linux kernel vulnerability in the AF_PACKET socket subsystem. The flaw affects the non-ring send paths packet_snd() and packet_sendmsg_spkt(). Both functions read dev->hard_header_len multiple times while allocating and constructing a socket buffer (skb). Concurrent device reconfiguration, such as a bonding device type change, can change this value between reads. For SOCK_RAW, this inconsistency allows skb->data to be moved before skb->head, causing the subsequent copy from userspace to perform an out-of-bounds write into kernel memory adjacent to the skb head. A local attacker with the ability to open packet sockets can trigger the race to corrupt kernel memory.

Critical Impact
Local out-of-bounds kernel heap write triggered via a race between packet socket send paths and concurrent device reconfiguration, enabling potential privilege escalation.

Affected Products

Linux kernel (upstream) net/packet subsystem prior to the fixed commits
Distribution kernels shipping the vulnerable packet_snd() and packet_sendmsg_spkt() code paths
Systems where AF_PACKET socket creation is available to unprivileged or capability-holding processes

Discovery Timeline

2026-08-21 - CVE-2026-74582 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74582

Vulnerability Analysis

The vulnerability resides in the packet_snd() and packet_sendmsg_spkt() functions in net/packet/af_packet.c. Both functions handle non-ring send paths for AF_PACKET sockets. Each function reads dev->hard_header_len more than once during skb allocation and construction. Because these reads are not serialized against device reconfiguration, the value can change between reads.

In the SOCK_RAW path within packet_snd(), a larger hard_header_len value is saved in the reserve variable at one point. A later allocation uses a smaller value for the headroom. When skb_reserve() moves skb->data back by the previously stored reserve, the pointer can land before skb->head. The subsequent memcpy_from_iter() from userspace then writes outside the allocated skb buffer, corrupting adjacent kernel heap memory. The packet_sendmsg_spkt() function exhibits the same pattern because it drops the RCU read lock between calculating its reservation and allocating the skb, allowing the underlying device state to change.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) race condition on dev->hard_header_len. The value is treated as stable across multiple reads within a single send operation, but device type changes such as bonding reconfiguration mutate it concurrently. This is a boundary condition error compounded by inconsistent state between allocation and copy phases.

Attack Vector

Exploitation requires local access and the ability to create AF_PACKET sockets, typically gated by CAP_NET_RAW. An attacker opens a SOCK_RAW packet socket bound to a device that can undergo type reconfiguration, then races sendto() or sendmsg() calls against concurrent operations that change the interface's link layer characteristics. Winning the race causes an out-of-bounds write whose contents are controlled by the userspace payload, providing a primitive suitable for kernel heap corruption and privilege escalation.

No public proof-of-concept exploit is available for CVE-2026-74582. Refer to the upstream fix commits for technical details of the corrected allocation logic.

Detection Methods for CVE-2026-74582

Indicators of Compromise

Kernel oops or panic messages referencing packet_snd, packet_sendmsg_spkt, skb_reserve, or slab corruption in dmesg and /var/log/kern.log
KASAN reports of out-of-bounds writes in net/packet/af_packet.c on kernels built with sanitizers
Unexpected process crashes or kernel warnings correlated with heavy AF_PACKET socket usage combined with device reconfiguration events

Detection Strategies

Audit process activity for unprivileged or low-privilege processes creating SOCK_RAW packet sockets alongside ioctl calls that change interface type or bonding membership
Correlate netlink events showing device type or master changes with concurrent sendto/sendmsg syscalls from the same process tree
Use eBPF tracing on packet_snd and dev_change_flags to flag interleaved calls originating from the same user session

Monitoring Recommendations

Enable kernel auditing (auditd) for socket syscalls with family=AF_PACKET and for ioctl operations affecting network interfaces
Forward kernel ring buffer messages to a centralized log platform and alert on slab or KASAN corruption signatures
Track CAP_NET_RAW capability grants across containers and workloads to reduce the population of processes able to reach the vulnerable code path

How to Mitigate CVE-2026-74582

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below or update to a distribution kernel that incorporates them
Restrict CAP_NET_RAW on production systems and container workloads that do not require raw packet access
Disable or restrict unprivileged user namespace creation where feasible, since it can be used to obtain CAP_NET_RAW in a namespace

Patch Information

The issue is fixed upstream by reading hard_header_len once in packet_snd() and using it consistently for allocation and construction, and by preserving the allocation-time value through the device lookup retry in packet_sendmsg_spkt(). A new LL_RESERVED_SPACE_EX() helper is introduced for callers that already saved a header length. Relevant commits include 03390aa32e66, 142e287b3a25, 5bb10753d428, 78a47127e33c, 905275629096, 91f041451f96, b06b6fce6d7d, and bcd4df60ac94.

Workarounds

Drop CAP_NET_RAW from workloads and container profiles that do not require raw socket access using seccomp or Linux capability bounding sets
Block AF_PACKET socket creation via seccomp filters or SELinux/AppArmor policies for high-risk services
Prevent unprivileged processes from creating user namespaces by setting kernel.unprivileged_userns_clone=0 on distributions that expose this sysctl

bash

# Configuration example: restrict AF_PACKET and unprivileged namespaces
sysctl -w kernel.unprivileged_userns_clone=0

# Sample seccomp rule fragment (JSON) to deny AF_PACKET socket creation
# {
#   "syscalls": [
#     {
#       "name": "socket",
#       "action": "SCMP_ACT_ERRNO",
#       "args": [ { "index": 0, "op": "SCMP_CMP_EQ", "value": 17 } ]
#     }
#   ]
# }

# Verify installed kernel includes the fix commit
uname -r