Linux Kernel CVE-2026-74582

Exploitation requires a local authenticated account with CAP_NET_RAW capability or equivalent access to AF_PACKET sockets, which in some Linux configurations with user namespace support may be accessible without traditional elevated privileges. The vulnerability is triggered specifically during a SOCK_RAW packet_snd() or packet_sendmsg_spkt() call that races concurrently with a device reconfiguration that changes dev->hard_header_len - the canonical example being a bonding interface undergoing a device type change. The attacker must either control the device reconfiguration side of the race or time the attack to coincide with a legitimate reconfiguration event. Systems without bonding interfaces or other runtime-reconfigurable link-layer drivers present a substantially reduced race window. What limits exploitation: the requirement for local shell access, the CAP_NET_RAW capability, the presence of a dynamically reconfigurable network device, and the need to win a TOCTOU timing window. The SOCK_DGRAM consistency issue between hard_header_len and header_ops->create noted in the patch description as out-of-scope is a distinct residual condition not covered by this fix.

The vendor CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly anchors this as a local privilege escalation with high impact, but the AC:L rating warrants scrutiny - winning a TOCTOU race against concurrent device reconfiguration involves specific timing, and an independent assessment of AC:H is defensible unless the attacker can orchestrate both sides of the race unilaterally. The C:H/I:H/A:H impact triad reflects the realistic consequence of a kernel OOB write primitive, which historically provides a reliable path to root. EPSS at 0.16% (5th percentile) and the absence of a CISA KEV listing indicate no current known exploitation, but EPSS frequently lags behind private exploit development for kernel primitives - even a mid-sized municipal IT team in swidnica managing a fleet of multi-tenant Linux servers should treat this as a high-priority patch given how powerful kernel memory corruption primitives are in practice. The SOCK_RAW attack path requires CAP_NET_RAW or equivalent packet socket access, which limits the population of exploitable accounts but is not an unusual capability in containerized or network-administration contexts. The separate SOCK_DGRAM consistency issue noted in the patch description as out-of-scope is a residual risk not addressed by this fix. Patch availability across stable branches (6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2) makes the remediation path clear.

A local attacker with a low-privilege account and access to AF_PACKET sockets opens a SOCK_RAW socket and concurrently triggers bonding device type reconfiguration - either by controlling the bonding configuration themselves or timing alongside a legitimate administrator action - to race packet_snd()'s two reads of dev->hard_header_len. When the race succeeds, skb->data is placed before skb->head, and the attacker's send operation copies attacker-controlled bytes to an out-of-bounds kernel memory region, yielding a write primitive that can be chained via known kernel exploitation techniques to overwrite credentials or function pointers and achieve root. No public proof-of-concept is known at time of analysis.