CVE-2026-74668: Linux Kernel Race Condition Vulnerability

CVE-2026-74668 Overview

CVE-2026-74668 is a race condition in the Linux kernel's AF_PACKET TX_RING send path. The flaw resides in tpacket_snd(), which reads dev->hard_header_len independently for socket buffer (skb) allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can shrink the reserved headroom below the amount later pushed, or drive copylen - hard_header_len negative. The fix snapshots hard_header_len once before processing ring frames and passes the consistent value through the send path. The vulnerability affects local attackers who can open packet sockets and trigger device reconfiguration in parallel.

Critical Impact
A local attacker with CAP_NET_RAW can trigger memory corruption in the kernel packet layer, potentially leading to privilege escalation, information disclosure, or denial of service.

Affected Products

Linux kernel (mainline) — net/packet/af_packet.c TX_RING send path
Stable kernel branches referenced by the fix commits (016763e, 21b5953, 27e068d, 2a73b2c, 9c7e8ff, d48ea5c, d85d2fd, e79f59a)
Linux distributions shipping vulnerable kernel builds prior to the backported fix

Discovery Timeline

2026-08-22 - CVE-2026-74668 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74668

Vulnerability Analysis

The Linux kernel AF_PACKET socket family supports a memory-mapped TX_RING mechanism for high-throughput packet transmission. The tpacket_snd() function iterates ring frames and constructs an skb per frame using tpacket_fill_skb(). Both functions independently dereference dev->hard_header_len on the target network device.

Because hard_header_len is not sampled atomically, a concurrent ioctl or netlink operation that reconfigures the device (for example, changing the link type or MTU-related layer parameters) can change the value between the two reads. The allocator reserves headroom based on one value; the header construction path pushes bytes based on another. When the later value exceeds the earlier reserved headroom, the code writes past the allocated boundary. When copylen - hard_header_len underflows, the copy length becomes a large unsigned value.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) race on dev->hard_header_len. The field is read multiple times along the TX_RING send path without a stable snapshot, and netdevice reconfiguration is not serialized against active packet transmission. This is an atomicity violation on shared kernel state.

Attack Vector

Exploitation requires local access and the ability to open a packet socket with TX_RING configured, which typically needs CAP_NET_RAW. An attacker races two threads: one submits frames through the TX_RING while the other reconfigures the underlying netdevice to alter hard_header_len. Successful races produce out-of-bounds writes into the skb data area or corrupt copy operations governed by the underflowed length. The fix, applied across the referenced stable commits, reads hard_header_len once and passes the snapshot to tpacket_fill_skb(), ensuring the frame limit, headroom allocation, copy length, and skb construction all use the same value.

No public proof-of-concept is available at the time of publication. See the kernel commit d85d2fd for the full patch.

Detection Methods for CVE-2026-74668

Indicators of Compromise

Kernel oops or panic traces referencing tpacket_fill_skb, tpacket_snd, packet_sendmsg, or skb_push in net/packet/af_packet.c
KASAN reports of slab-out-of-bounds writes in skb head allocations originating from the packet TX path
Unexpected process crashes or hangs correlated with unprivileged processes holding CAP_NET_RAW

Detection Strategies

Inventory running kernel versions across the fleet and compare against distribution advisories referencing the fix commits
Audit processes that create AF_PACKET sockets with PACKET_TX_RING set via setsockopt, particularly from non-root users granted CAP_NET_RAW
Correlate netdevice reconfiguration events (link type or header length changes) with concurrent packet socket activity

Monitoring Recommendations

Enable KASAN in test environments to surface out-of-bounds accesses in the packet layer during fuzzing
Forward kernel ring buffer messages to a centralized log store and alert on af_packet stack traces
Track auditd events for capset and socket creation syscalls to identify processes exercising AF_PACKET capabilities

How to Mitigate CVE-2026-74668

Immediate Actions Required

Apply the vendor kernel update that includes the tpacket_snd() snapshot fix across all Linux hosts
Restrict CAP_NET_RAW to trusted workloads and remove it from container defaults where feasible
Prioritize patching hosts that permit unprivileged users to open AF_PACKET sockets, including multi-tenant systems and container hosts

Patch Information

The upstream fix is distributed across the following stable branches: 016763e, 21b5953, 27e068d, 2a73b2c, 9c7e8ff, d48ea5c, d85d2fd, and e79f59a. Consult your distribution's advisory for the corresponding package version.

Workarounds

Drop CAP_NET_RAW from container security profiles and systemd unit CapabilityBoundingSet where packet capture is not required
Use seccomp policies to block socket(AF_PACKET, ...) for workloads that do not require raw packet access
Restrict access to network interface reconfiguration ioctls and netlink operations to privileged administrative accounts

bash

# Drop CAP_NET_RAW in a systemd service unit
# /etc/systemd/system/example.service
[Service]
CapabilityBoundingSet=~CAP_NET_RAW
AmbientCapabilities=
NoNewPrivileges=yes

# Verify running kernel version against fixed builds
uname -r