EUVD-2026-64353
GHSA-qv67-9r8f-5pqx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition exploitation requires precise timing control not fully in the attacker's hands, warranting AC:H over the NVD-assigned AC:L; all other metrics align with local low-privilege kernel memory corruption impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
packet: synchronize pressure clearing with ring reconfiguration
packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage.
Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix.
Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again.
packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.
AnalysisAI
Race condition in the Linux kernel AF_PACKET socket subsystem allows a local low-privileged attacker to dereference stale or NULL ring storage, resulting in kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw arises because packet_set_ring() previously published the tpacket receive mode outside the sk_receive_queue.lock section used for ring state updates, enabling packet_poll() and packet_recvmsg() to run pressure-clearing paths against already-freed ring structures. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user session on a Linux host running a kernel version from 4.2 through the patched releases, and the ability to create AF_PACKET sockets - which requires the CAP_NET_RAW capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case local privilege-escalation potential from kernel memory corruption, and the C:H/I:H/A:H triad is credible if an attacker successfully wins the race and achieves arbitrary kernel write. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with low-privilege shell access on a Linux system opens an AF_PACKET socket and configures a tpacket RX ring, then races a concurrent packet_set_ring() reconfiguration call against packet_poll() or packet_recvmsg() executing the pressure-clearing path. If the race is won, __packet_rcv_has_room() dereferences the now-stale or NULL ring storage, potentially crashing the kernel (denial of service) or, with careful heap manipulation, enabling arbitrary kernel memory reads or writes leading to privilege escalation to root. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to a patched version: 6.6.152 or later on the 6.6 LTS branch, 6.12.104 or later on the 6.12 LTS branch, 6.18.45 or later on the 6.18 branch, 7.1.9 or later on the 7.1 branch, or 7.2 (mainline). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux distributions and kernel versions in your environment and cross-reference against your vendor's security advisories for CVE-2026-74666 patch availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today