CVE-2026-74582

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths

packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes.

For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write.

packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb.

Leer descripción completaMostrar menos

Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry.

The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.12%
Percentil entre todas las CVEs puntuadas: 2
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1059 Command and Scripting Interpreterexecution75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact70 %

Vulnerabilidad local (AV:L/PR:L) que permite escritura fuera de límites (out-of-bounds write) mediante manipulación de hard_header_len en el kernel Linux, escalando privilegios. Ejecución de código y DoS son posibles consecuencias.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Filter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-74582",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.4.133",
              "lessThan": "4.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.9.103",
              "lessThan": "4.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.14.44",
              "lessThan": "4.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.16.12",
              "lessThan": "4.17",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-21T17:16:44.507",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev->hard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb->data back by reserve\nthen places it before skb->head, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops->create is not addressed here."
    }
  ],
  "lastModified": "2026-08-27T13:18:34.533",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}