EUVD-2026-64354
GHSA-wqmr-77rq-877r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with CAP_NET_RAW required plus PACKET_QDISC_BYPASS activation; full kernel memory corruption impact justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/packet: reset the MAC header on the packet-socket transmit path
packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here.
For frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one consumer in commit f5089008f90c ("macsec: do not read an unset MAC header in macsec_encrypt()").
packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2 header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally, mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too.
Found by 0sec (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN report in f5089008f90c. Compile-tested.
AnalysisAI
Out-of-bounds memory access in the Linux kernel's packet socket subsystem (net/packet) allows a local attacker with CAP_NET_RAW or equivalent network namespace privileges to trigger kernel memory corruption via the PACKET_QDISC_BYPASS transmit path. The flaw exists because packet_parse_headers() fails to reset skb->mac_header for SOCK_DGRAM, SOCK_PACKET, and protocol-bound SOCK_RAW sockets, causing any driver that reads eth_hdr(skb) during transmit to dereference an address approximately 64 KiB past the socket buffer head. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions: (1) local access to the target system; (2) ability to create a packet socket, which requires CAP_NET_RAW capability or access to an unprivileged network namespace on kernels with user namespace support enabled; and (3) enabling the PACKET_QDISC_BYPASS socket option on a socket of type SOCK_DGRAM, SOCK_PACKET, or a protocol-bound SOCK_RAW - the non-default bypass path is the necessary trigger. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local exploitation requirement combined with high potential impact from kernel memory corruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker granted CAP_NET_RAW - for example, a container process with NET_RAW capability or a user in an unprivileged network namespace - creates a SOCK_DGRAM packet socket, enables PACKET_QDISC_BYPASS, and transmits a crafted Ethernet frame. The driver receives the frame with skb->mac_header set to 0xFFFF and dereferences memory approximately 64 KiB past the socket buffer head when calling eth_hdr(skb), triggering a kernel panic or exploitable memory corruption that may enable local privilege escalation. … |
| Remediation | Update to a patched stable kernel release: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2, depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running vulnerable kernel versions and assess exposure in environments allowing untrusted local code execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today