CVE-2026-74582: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74582 is an out-of-bounds write vulnerability in the Linux kernel's packet socket implementation, caused by inconsistent reads of dev->hard_header_len during concurrent device reconfiguration. Specifically, packet_snd() and packet_sendmsg_spkt() may read different values of hard_header_len across multiple accesses, leading to skb->data being positioned before skb->head and enabling an out-of-bounds write during a subsequent copy from userspace. The vulnerability was disclosed on August 21, 2026, and affects multiple Linux kernel versions from 4.4.133 through the 6.x series prior to patched releases. It is classified as HIGH severity with an estimated CVSS category of HIGH (Red Hat CVE, GitHub Advisory).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-787: Out-of-bounds Write) in the Linux kernel's packet socket send paths. packet_snd() reads dev->hard_header_len multiple times: once to calculate the headroom reservation and again during skb allocation. If a concurrent bonding device type change reduces hard_header_len between these reads, the skb is allocated with less headroom than reserved, causing skb->data to be moved before skb->head. The subsequent copy_from_user() then writes out-of-bounds into kernel memory. packet_sendmsg_spkt() is similarly affected because it reads hard_header_len separately before and after dropping the RCU read lock for skb allocation. The fix introduces LL_RESERVED_SPACE_EX() and ensures a single consistent read of hard_header_len is used throughout both functions (Red Hat CVE, GitHub Advisory).

A local attacker with the capability to create raw packet sockets (e.g., CAP_NET_RAW) can trigger an out-of-bounds write into kernel memory by racing concurrent network device reconfiguration (such as bonding device type changes) against packet transmission. This can result in arbitrary kernel memory corruption, potentially leading to privilege escalation or kernel code execution. The integrity and availability of the affected system are at significant risk, and successful exploitation could allow full system compromise (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability requires local access and the CAP_NET_RAW capability, limiting the attack surface to privileged local users or processes. The EPSS score is approximately 0.156%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection is available via Nessus plugin 338783 (Tenable).

1. Gain local access: Obtain a local shell on the target Linux system with CAP_NET_RAW capability (e.g., as root or via a process with the capability granted).
2. Set up a bonding device: Configure a bonding network interface that supports dynamic device type changes, which will be used to trigger concurrent hard_header_len modifications.
3. Open a SOCK_RAW packet socket: Create a raw packet socket using socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) targeting the bonding interface.
4. Race device reconfiguration with packet send: In one thread, continuously trigger bonding device type changes (e.g., by switching bonding modes) to cause dev->hard_header_len to fluctuate. In a parallel thread, call sendmsg() or send() on the raw socket to invoke packet_snd().
5. Trigger out-of-bounds write: When the race condition is won, packet_snd() reserves headroom based on a larger hard_header_len but allocates the skb with a smaller value, placing skb->data before skb->head. The subsequent copy_from_user() writes attacker-controlled data out-of-bounds into kernel memory.
6. Achieve kernel code execution: Leverage the kernel memory corruption to overwrite function pointers, security structures, or other critical kernel data to escalate privileges or execute arbitrary code (Red Hat CVE, GitHub Advisory).

• Process: Unusual processes with CAP_NET_RAW capability creating AF_PACKET/SOCK_RAW sockets, especially combined with rapid bonding interface reconfiguration.
• Logs: Kernel logs (dmesg) showing memory corruption warnings, BUG/OOPS messages, or stack traces originating from packet_snd() or packet_sendmsg_spkt(); entries referencing skb->data before skb->head.
• Network: Repeated bonding device type changes or mode switches in a short time window, visible in /var/log/syslog or journalctl as bond0: link status or bonding: bond0: change device type messages.
• File System: Unexpected privilege escalation artifacts (new SUID binaries, modified /etc/passwd, new cron jobs) following suspicious raw socket activity.

Apply kernel updates containing the fix commits for the relevant stable branches: 6.6.152, 6.12.104, 6.18.45, 7.1.9, or upgrade to kernel 7.2 or later (Red Hat CVE, GitHub Advisory). As a workaround, restrict the CAP_NET_RAW capability to only trusted users and processes using tools such as setcap, seccomp profiles, or AppArmor/SELinux policies. Monitor for and restrict unauthorized bonding device reconfiguration on sensitive systems until patches are applied.

The vulnerability was noted by VulDB and tracked by ENISA's EUVD database shortly after disclosure (ENISA EUVD). Red Hat published a CVE advisory and associated Bugzilla entry (Red Hat CVE). No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability tracking and aggregation sites.