EUVD-2026-64355
GHSA-j5cf-5xp4-r57f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires winning a precise timing window against concurrent netdevice reconfiguration, warranting AC:H over the official AC:L despite low-privilege local access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in TX_RING send path
tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.
Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
AnalysisAI
Race condition in the Linux kernel's AF_PACKET TX_RING send path allows a low-privileged local user to trigger kernel heap memory corruption by racing a concurrent netdevice reconfiguration. The tpacket_snd() function reads dev->hard_header_len independently at two points - for SKB headroom allocation and for header construction in tpacket_fill_skb() - so a device reconfiguration between those two reads can cause the reserved headroom to be smaller than what is later pushed, or make copylen minus hard_header_len negative. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with the ability to create an AF_PACKET socket, which on most Linux systems requires either CAP_NET_RAW capability or access to user namespaces with kernel.unprivileged_userns_clone=1 (the default on many distributions including Ubuntu). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.8 with AC:L may overstate ease of exploitation: winning a race condition against a concurrent netdevice reconfiguration event requires precise timing, and real-world reliability depends heavily on system activity and scheduling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel version: 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2, applying the upstream stable commits at https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd, https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7, https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc, https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a, or https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems in your infrastructure and determine which kernel versions are deployed; cross-reference against vendor advisories to identify systems missing the AF_PACKET race condition fix. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today