CVE-2026-74667 (GCVE-0-2026-74667)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-25 05:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/packet: reset the MAC header on the packet-socket transmit path
packet_parse_headers() resets the MAC header only for a SOCK_RAW frame
whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,
any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave
skb->mac_header unset here.
For frames sent via __dev_queue_xmit() this is harmless: it resets the
MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS
path uses dev_direct_xmit(), which does not, so the frame reaches
ndo_start_xmit() with the MAC header unset. A driver that reads
eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an
out-of-bounds access ~64 KiB past the head -- the same class fixed for
one consumer in commit f5089008f90c ("macsec: do not read an unset MAC
header in macsec_encrypt()").
packet_parse_headers() runs only on the transmit path, where skb->data
points at the start of the L2 header for every packet-socket type
regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied
header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC
header unconditionally, mirroring __dev_queue_xmit(), so the frame is
anchored on the bypass path too.
Found by 0sec (https://0sec.ai) using automated source analysis;
verified against source and matched to the macsec KASAN report in
f5089008f90c. Compile-tested.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 Version: 75c65772c3d18447d62d3aca5f91b06c16cc25e4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e43a1d66615f411d427f9df1f46dd049d9e3681",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "4057853a91fb796c4f47c7d1baf1aa085394148e",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "2610ed4e86a4590234a9d70518c469751c5af231",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "b47ba8fe6e1d2df8c92048de5afafd059447dc30",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "971aa7d99242bbf09513e27b7a243f0b29ff23ae",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "fdd4d7d52358a58e351dd9d82530c04eba8ccd7a",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
},
{
"lessThan": "c2707480cfbf19c7619acc9c089d17f20869821f",
"status": "affected",
"version": "75c65772c3d18447d62d3aca5f91b06c16cc25e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb-\u003emac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb-\u003ehead + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb-\u003edata\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only via local AF_PACKET transmit syscalls (sendmsg on SOCK_DGRAM/bound SOCK_RAW with PACKET_QDISC_BYPASS); remote network input cannot trigger packet_parse_headers() on this TX path.\nAC:L - The attacker controls socket type, enables PACKET_QDISC_BYPASS via setsockopt, selects a vulnerable netdev (macsec/macvlan/tap), and sends frames to reliably hit dev_direct_xmit() without races or external victim state.\nPR:L - packet_create() requires CAP_NET_RAW, which unprivileged users commonly obtain inside user+network namespaces (unshare -Urn) per kernel capability rules, not solely real root in the init namespace.\nUI:N - Exploitation requires only the attacker opening a packet socket, enabling bypass, and transmitting; no victim user action such as opening files or mounting filesystems is needed.\nS:U - Impact is kernel heap/slab disclosure and transmit-time corruption within the same kernel security authority; it is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Unset mac_header makes eth_hdr(skb) a large out-of-bounds kernel memory read (~64 KiB past skb-\u003ehead); macsec KASAN confirmed slab data leakage and bytes can be emitted on the wire in the frame.\nI:H - Affected TX drivers consume the bogus eth_hdr() pointer to modify skbs (e.g., macsec memmove of OOB MAC bytes into the frame, vxlan header rewrites), giving attacker-influenced corruption beyond a pure read.\nA:H - The invalid mac_header dereference can fault or trigger KASAN/driver failures during ndo_start_xmit(), causing kernel oops/panic or repeated transmit failure on the bypass path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:21.641Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681"
},
{
"url": "https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e"
},
{
"url": "https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231"
},
{
"url": "https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30"
},
{
"url": "https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d"
},
{
"url": "https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae"
},
{
"url": "https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a"
},
{
"url": "https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f"
}
],
"title": "net/packet: reset the MAC header on the packet-socket transmit path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74667",
"datePublished": "2026-08-22T15:32:38.862Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-25T05:41:21.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…