CVE-2026-74667: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74667 Overview

CVE-2026-74667 is an out-of-bounds read vulnerability in the Linux kernel's net/packet subsystem. The flaw resides in packet_parse_headers(), which only resets the MAC header for SOCK_RAW frames whose sockets did not bind a protocol. Protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and legacy SOCK_PACKET frames leave skb->mac_header unset. When such frames traverse the PACKET_QDISC_BYPASS path via dev_direct_xmit(), drivers that read eth_hdr(skb) on transmit dereference skb->head + (u16)~0, an out-of-bounds access approximately 64 KiB past the head.

Critical Impact
A local attacker with the ability to open packet sockets can trigger an out-of-bounds read on the kernel transmit path, leading to memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel (multiple stable branches, per referenced fix commits)
Systems exposing AF_PACKET sockets to unprivileged or containerized workloads
Network drivers that read eth_hdr(skb) during transmit

Discovery Timeline

Vulnerability found by 0sec using automated source analysis, verified against source and matched to the macsec KASAN report in commit f5089008f90c
2026-08-22 - CVE-2026-74667 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74667

Vulnerability Analysis

The defect lives in the packet-socket transmit path. packet_parse_headers() conditionally resets skb->mac_header, covering only SOCK_RAW frames without a bound protocol. Every other packet-socket variant leaves the MAC header offset uninitialized. Frames dispatched through __dev_queue_xmit() are safe because that function unconditionally resets the MAC header. Frames routed through the PACKET_QDISC_BYPASS optimization use dev_direct_xmit() instead, which performs no such reset. Consequently, the frame reaches ndo_start_xmit() with skb->mac_header still set to its default sentinel value.

Any driver that calls eth_hdr(skb) on transmit computes an address as skb->head + (u16)~0, producing an out-of-bounds read roughly 64 KiB beyond the buffer head. This is the same class of defect resolved for macsec_encrypt() in commit f5089008f90c.

Root Cause

The conditional check in packet_parse_headers() narrows MAC header initialization to a single socket configuration. Because skb->data reliably points at the start of the L2 header for every packet-socket variant on transmit, whether the header was user-supplied (SOCK_RAW, SOCK_PACKET) or built by dev_hard_header() (SOCK_DGRAM), the reset should be unconditional. The upstream fix removes the condition and mirrors the behavior of __dev_queue_xmit(), anchoring the frame on the bypass path.

Attack Vector

Exploitation requires local access with permission to open an AF_PACKET socket. An attacker crafts SOCK_DGRAM, protocol-bound SOCK_RAW, or SOCK_PACKET frames and enables PACKET_QDISC_BYPASS. Transmitting through a driver that reads eth_hdr(skb) triggers the out-of-bounds read. Depending on adjacent memory contents, the primitive supports information disclosure, kernel memory corruption, or a system crash.

No exploit is publicly available at this time. Technical details are documented in the referenced kernel commits.

Detection Methods for CVE-2026-74667

Indicators of Compromise

Kernel oops or KASAN reports referencing eth_hdr, packet_parse_headers, or dev_direct_xmit on the transmit path
Unexpected process crashes or kernel panics tied to processes issuing sendto() on AF_PACKET sockets
Unprivileged or containerized workloads holding CAP_NET_RAW and enabling PACKET_QDISC_BYPASS

Detection Strategies

Audit kernel version and backport status against the fix commits (1e43a1d, 2610ed4e, 284f3e7a, 4057853a, 971aa7d9, b47ba8fe, c2707480, fdd4d7d5).
Instrument syscall auditing for socket(AF_PACKET, …) combined with setsockopt(PACKET_QDISC_BYPASS) to surface workloads capable of reaching the vulnerable path.
Correlate driver-level crash telemetry with packet-socket activity from the same process context.

Monitoring Recommendations

Ship kernel ring buffer and KASAN output to a central data lake for pattern analysis.
Track container escapes or privilege changes that grant CAP_NET_RAW outside expected workloads.
Alert on repeated packet-socket transmit failures from a single process, which may indicate probing.

How to Mitigate CVE-2026-74667

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the fix commits to all affected stable branches.
Inventory hosts and container images running unpatched kernels and prioritize those exposing AF_PACKET to untrusted workloads.
Restrict CAP_NET_RAW to workloads that require it; remove the capability from container defaults where feasible.

Patch Information

The fix removes the conditional in packet_parse_headers() and resets skb->mac_header unconditionally on the packet-socket transmit path. Refer to the stable-tree fixes: commit 1e43a1d, commit 2610ed4e, commit 284f3e7a, commit 4057853a, commit 971aa7d9, commit b47ba8fe, commit c2707480, and commit fdd4d7d5.

Workarounds

Drop CAP_NET_RAW from container security profiles and unprivileged user namespaces where packet sockets are not required.
Use seccomp policies to block socket(AF_PACKET, …) for workloads that do not need raw packet access.
Disable user namespaces on hosts where they are not needed to reduce the attack surface for AF_PACKET access.

bash

# Configuration example: block AF_PACKET via seccomp and audit packet-socket use
# 1) Restrict CAP_NET_RAW in systemd services
sudo systemctl edit myservice
# Add under [Service]:
#   CapabilityBoundingSet=~CAP_NET_RAW
#   AmbientCapabilities=
#   RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

# 2) Audit AF_PACKET socket creation
sudo auditctl -a always,exit -F arch=b64 -S socket -F a0=17 -k af_packet_use

# 3) Verify kernel version includes the fix
uname -r