CVE-2026-74667

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net/packet component where the packet parse headers() function fails to reset the MAC header for protocol-bound SOCK RAW sockets, SOCK DGRAM frames, and the legacy SOCK PACKET path. While this is harmless for frames sent via dev queue xmit(), the PACKET QDISC BYPASS path utilizes dev direct xmit(), which does not reset the header. Consequently, frames reach ndo start xmit() with the MAC header unset. If a driver attempts to read eth hdr(skb) during transmission, it results in an out-of-bounds memory access approximately 64 KiB past the head.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.