CVE-2026-74667

A flaw was found in the Linux kernel's networking packet handling. Specifically, the packet_parse_headers() function does not consistently reset the Media Access Control (MAC) header for certain packet types on the PACKET_QDISC_BYPASS path. This can lead to an unset MAC header, causing a driver to perform an out-of-bounds read when processing network frames. This memory corruption vulnerability could result in system instability or a denial of service.

A moderate severity flaw was found in the Linux kernel's packet socket (AF_PACKET) transmit path, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 as well as Red Hat In-Vehicle OS. The packet_parse_headers() function resets the skb MAC header only for a SOCK_RAW frame whose socket did not bind a protocol; protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset. Frames sent through the regular __dev_queue_xmit() path are not affected because it resets the MAC header unconditionally, but frames sent on the PACKET_QDISC_BYPASS path through dev_direct_xmit() reach the driver's ndo_start_xmit() with the MAC header unset. A local attacker able to transmit frames through a packet socket (SOCK_RAW requires CAP_NET_RAW, while SOCK_DGRAM does not) could exploit this so that a driver reading eth_hdr(skb) on transmit dereferences memory roughly 64 KiB past the start of the socket buffer, an out-of-bounds read that can crash the system and cause a denial of service. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that release. The fix is currently deferred on the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams; given the Moderate rating and the local, availability-only nature of the flaw, the residual risk is a local denial of service by an attacker with packet-socket transmit access. Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVEORG rating of Important (7.8 with high confidentiality and integrity impact); no path to information disclosure or privilege escalation has been established beyond the out-of-bounds read and the resulting crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.