Linux Kernel CVE-2026-68338

The vulnerability resides in the AF_PACKET raw socket subsystem (net/packet), specifically within packet_set_ring(), which reconfigures the memory-mapped ring buffer for a packet socket. During reconfiguration, the function temporarily releases po->bind_lock after recording was_running and unregistering the protocol hook. This unlocked window creates a TOCTOU race with the NETDEV_UNREGISTER kernel notifier path: if a network device is removed during this window, the notifier may skip __unregister_prot_hook() (observing the socket as not running), then invalidate the socket's device binding by setting po->ifindex to -1 and clearing po->prot_hook.dev. A one-member fanout group can still hold a stale fanout hook device pointer. When packet_set_ring() reacquires the lock and re-registers based solely on the stale was_running flag, it re-adds the fanout hook referencing an already-freed or unregistered device structure. The fix distinguishes po->ifindex == -1 (binding explicitly invalidated by device removal) from ifindex 0 (unbound/wildcard), and skips hook re-registration when invalidation has occurred. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. CWE classification is not formally assigned, but the root cause class is a TOCTOU race condition with use of invalidated pointer/state (analogous to CWE-362 and CWE-416).