CVE-2026-74668

A flaw was found in the Linux kernel's packet handling mechanism. During concurrent network device reconfigurations, an inconsistency in how the hard_header_len value is used can lead to memory corruption. This issue could allow an attacker to cause a denial of service by triggering a system crash or potentially lead to other unpredictable system behavior.

AF_PACKET TX_RING send can use inconsistent hard_header_len values when tpacket_snd() races with netdevice reconfiguration. The skb may be allocated with smaller reserved headroom than the amount later pushed in tpacket_fill_skb(), or copylen minus hard_header_len may become negative, which can trigger skb bounds checks and a kernel crash. For the CVSS the PR:L is used in the paranoid score because reduced capability root, container root, or delegated CAP_NET_RAW and CAP_NET_ADMIN access may be enough to reach the packet socket and reconfiguration path. The issue is local and is not directly network reachable. Impact is at least denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.