Linux Kernel CVE-2026-74667

Exploitation requires all three of the following conditions: (1) local access to the target system; (2) ability to create a packet socket, which requires CAP_NET_RAW capability or access to an unprivileged network namespace on kernels with user namespace support enabled; and (3) enabling the PACKET_QDISC_BYPASS socket option on a socket of type SOCK_DGRAM, SOCK_PACKET, or a protocol-bound SOCK_RAW - the non-default bypass path is the necessary trigger. Additionally, the vulnerability is only triggered by drivers that call eth_hdr(skb) during ndo_start_xmit(); drivers that do not read the MAC header in the transmit path will not fault even on unpatched kernels, meaning the specific network driver in use is a secondary limiting factor. Exploitation is strictly local - no network-based trigger exists. Default container deployments that grant NET_RAW (e.g., Docker run without explicit capability dropping) represent the most realistic elevated-risk exposure.

The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local exploitation requirement combined with high potential impact from kernel memory corruption. EPSS is very low at 0.23% (14th percentile), consistent with the local-only attack surface and the dependency on a non-default socket option (PACKET_QDISC_BYPASS) and a driver that reads eth_hdr(skb) on transmit - both of which constrain the exploitable population meaningfully. No CISA KEV entry exists and no public exploit code has been identified; the vulnerability was discovered through automated source code analysis rather than observed in-the-wild exploitation. Despite C:H/I:H/A:H ratings, real-world risk is most acute in container environments where CAP_NET_RAW is granted to untrusted workloads (common in Docker with --cap-add NET_RAW or Kubernetes pods with privileged networking), and in multi-tenant Linux systems with permissive seccomp profiles. For hardened deployments that strip CAP_NET_RAW or block raw socket creation, the effective risk is significantly reduced. This is a genuine kernel memory safety issue warranting patching on a normal patch cycle, but it does not represent the same urgency as a network-exploitable kernel bug.

A local attacker granted CAP_NET_RAW - for example, a container process with NET_RAW capability or a user in an unprivileged network namespace - creates a SOCK_DGRAM packet socket, enables PACKET_QDISC_BYPASS, and transmits a crafted Ethernet frame. The driver receives the frame with skb->mac_header set to 0xFFFF and dereferences memory approximately 64 KiB past the socket buffer head when calling eth_hdr(skb), triggering a kernel panic or exploitable memory corruption that may enable local privilege escalation. No proof-of-concept exploit is publicly known; the bug was identified via automated source code analysis and validated against an existing KASAN report.