CVE-2026-74582

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the packet handling of the Linux kernel where packet snd() and packet sendmsg spkt() read the hard header len value multiple times during the allocation and construction of a socket buffer (skb). If a device reconfiguration occurs concurrently, such as changes to a bonding device type, this value can change. For SOCK RAW, this inconsistency can lead to a situation where a larger value is reserved but a smaller value is used for headroom allocation. Consequently, moving skb->data back by the reserved amount can place it before skb->head, potentially allowing an out-of-bounds write during the copy from userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.