CVE-2026-74666

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74666", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.924Z", "datePublished": "2026-08-22T15:32:38.098Z", "dateUpdated": "2026-10-16T19:16:08.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:40:00.544Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: synchronize pressure clearing with ring reconfiguration\n\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\nbut used to publish the tpacket receive mode through po->prot_hook.func\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\nrun the pressure clearing path after the ring has been cleared while\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\nstale or NULL ring storage.\n\nMove the existing receive hook assignment into the same\nsk_receive_queue.lock section as the ring state update. Keep the\nassignment otherwise unchanged, including on TX ring reconfiguration, to\navoid adding behavior changes that are not required for the fix.\n\nSerialize packet_recvmsg() pressure clearing with the same queue lock\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\nalready detached the socket and waited for synchronize_net(), so no new\npacket input can set the flag again.\n\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\nunlocked helper directly."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is hit only from local AF_PACKET syscalls\u2014setsockopt(PACKET_RX_RING) racing poll(2)/recvmsg(2) pressure clearing in packet_poll()/packet_recvmsg()\u2014not from remote packet receive paths like ksmbd, nfsd, or the TCP/IP stack.\nAC:L - The attacker controls both race sides: one thread polls/recvmsg while PACKET_SOCK_PRESSURE is set, another tears down the RX ring via PACKET_RX_RING; packet_set_ring()'s synchronize_net() window makes the stale tpacket_rcv vs NULL/freed pg_vec mismatch reliably winnable.\nPR:L - packet_create() requires ns_capable(net->user_ns, CAP_NET_RAW); unprivileged users obtain CAP_NET_RAW via user+network namespaces (unshare -Urn) or container defaults (Docker NET_RAW), without init-namespace root.\nUI:N - No victim action is required; the attacker creates the AF_PACKET socket, configures the mmap RX ring, fills it to set PACKET_SOCK_PRESSURE, and races ring teardown against its own poll/recvmsg calls.\nS:U - Stale/NULL ring dereferences corrupt kernel heap state on the same host; this is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - __packet_rcv_has_room() follows tpacket_rcv and dereferences rb->pg_vec or prb_bdqc block pointers after packet_set_ring() cleared/freed the ring, yielding NULL-dereference or use-after-free reads of ring metadata and mmap-backed pages.\nI:H - Freed ring storage and stale prb_bdqc/pkbdq pointers remain attacker-influenced through mmap and concurrent ring operations, providing a controllable kernel heap use-after-free write primitive typical of AF_PACKET ring reconfiguration races.\nA:H - NULL pg_vec indexing in packet_lookup_frame() or stale block access in prb_lookup_block() from the pressure-clearing path causes an immediate kernel oops/panic, giving any qualifying local attacker repeatable host-wide denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "bf3c8e86bc8ad111be3f3136125e255344bcb3da", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "8cfb2e71926a682f36c4240067d424074dd8f70f", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "f015c9de92b731814059a343b765c60c0196225c", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "cf8189b82bb93f219ab740e0346c919ad65ada62", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "ad740b4990347521f0db260d381f9f74e7b340ba", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "2c7b5eb87b2b288cdbde825f21d2b83b2f5da747", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "a08196c3cc105947746ec21309edfbb60275fcdb", "status": "affected", "versionType": "git"}, {"version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "1a35da325cac4d5bcad76a2aa943408a6f1d9000", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/packet/af_packet.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.267", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.218", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.185", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.218"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da"}, {"url": "https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f"}, {"url": "https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c"}, {"url": "https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62"}, {"url": "https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba"}, {"url": "https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747"}, {"url": "https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb"}, {"url": "https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000"}], "title": "packet: synchronize pressure clearing with ring reconfiguration", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74666", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:12.266180Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:08.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74666", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:12.266180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:14:12.843Z"}}], "cna": {"title": "packet: synchronize pressure clearing with ring reconfiguration", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is hit only from local AF_PACKET syscalls\u2014setsockopt(PACKET_RX_RING) racing poll(2)/recvmsg(2) pressure clearing in packet_poll()/packet_recvmsg()\u2014not from remote packet receive paths like ksmbd, nfsd, or the TCP/IP stack.\nAC:L - The attacker controls both race sides: one thread polls/recvmsg while PACKET_SOCK_PRESSURE is set, another tears down the RX ring via PACKET_RX_RING; packet_set_ring()'s synchronize_net() window makes the stale tpacket_rcv vs NULL/freed pg_vec mismatch reliably winnable.\nPR:L - packet_create() requires ns_capable(net->user_ns, CAP_NET_RAW); unprivileged users obtain CAP_NET_RAW via user+network namespaces (unshare -Urn) or container defaults (Docker NET_RAW), without init-namespace root.\nUI:N - No victim action is required; the attacker creates the AF_PACKET socket, configures the mmap RX ring, fills it to set PACKET_SOCK_PRESSURE, and races ring teardown against its own poll/recvmsg calls.\nS:U - Stale/NULL ring dereferences corrupt kernel heap state on the same host; this is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - __packet_rcv_has_room() follows tpacket_rcv and dereferences rb->pg_vec or prb_bdqc block pointers after packet_set_ring() cleared/freed the ring, yielding NULL-dereference or use-after-free reads of ring metadata and mmap-backed pages.\nI:H - Freed ring storage and stale prb_bdqc/pkbdq pointers remain attacker-influenced through mmap and concurrent ring operations, providing a controllable kernel heap use-after-free write primitive typical of AF_PACKET ring reconfiguration races.\nA:H - NULL pg_vec indexing in packet_lookup_frame() or stale block access in prb_lookup_block() from the pressure-clearing path causes an immediate kernel oops/panic, giving any qualifying local attacker repeatable host-wide denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "bf3c8e86bc8ad111be3f3136125e255344bcb3da", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "8cfb2e71926a682f36c4240067d424074dd8f70f", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "f015c9de92b731814059a343b765c60c0196225c", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "cf8189b82bb93f219ab740e0346c919ad65ada62", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "ad740b4990347521f0db260d381f9f74e7b340ba", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "2c7b5eb87b2b288cdbde825f21d2b83b2f5da747", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "a08196c3cc105947746ec21309edfbb60275fcdb", "versionType": "git"}, {"status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "lessThan": "1a35da325cac4d5bcad76a2aa943408a6f1d9000", "versionType": "git"}], "programFiles": ["net/packet/af_packet.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.267", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.218", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.185", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/packet/af_packet.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da"}, {"url": "https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f"}, {"url": "https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c"}, {"url": "https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62"}, {"url": "https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba"}, {"url": "https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747"}, {"url": "https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb"}, {"url": "https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: synchronize pressure clearing with ring reconfiguration\n\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\nbut used to publish the tpacket receive mode through po->prot_hook.func\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\nrun the pressure clearing path after the ring has been cleared while\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\nstale or NULL ring storage.\n\nMove the existing receive hook assignment into the same\nsk_receive_queue.lock section as the ring state update. Keep the\nassignment otherwise unchanged, including on TX ring reconfiguration, to\navoid adding behavior changes that are not required for the fix.\n\nSerialize packet_recvmsg() pressure clearing with the same queue lock\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\nalready detached the socket and waited for synchronize_net(), so no new\npacket input can set the flag again.\n\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\nunlocked helper directly."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.267", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.218", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.185", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T12:40:00.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74666", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:16:08.102Z", "dateReserved": "2026-08-15T05:44:03.924Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:38.098Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bf3c8e86bc8ad111be3f3136125e255344bcb3da", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "8cfb2e71926a682f36c4240067d424074dd8f70f", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "f015c9de92b731814059a343b765c60c0196225c", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "cf8189b82bb93f219ab740e0346c919ad65ada62", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "ad740b4990347521f0db260d381f9f74e7b340ba", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "2c7b5eb87b2b288cdbde825f21d2b83b2f5da747", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "a08196c3cc105947746ec21309edfbb60275fcdb", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}, {"lessThan": "1a35da325cac4d5bcad76a2aa943408a6f1d9000", "status": "affected", "version": "2ccdbaa6d55b0656244ba57c4b56765a0af76c0a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.267", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.218", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.185", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: synchronize pressure clearing with ring reconfiguration\n\npacket_set_ring() updates the RX ring state under sk_receive_queue.lock,\nbut used to publish the tpacket receive mode through po->prot_hook.func\nafter releasing that lock. packet_poll() and packet_recvmsg() can then\nrun the pressure clearing path after the ring has been cleared while\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference\nstale or NULL ring storage.\n\nMove the existing receive hook assignment into the same\nsk_receive_queue.lock section as the ring state update. Keep the\nassignment otherwise unchanged, including on TX ring reconfiguration, to\navoid adding behavior changes that are not required for the fix.\n\nSerialize packet_recvmsg() pressure clearing with the same queue lock\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear\nand the socket has moved away from tpacket_rcv, packet_set_ring() has\nalready detached the socket and waited for synchronize_net(), so no new\npacket input can set the flag again.\n\npacket_poll() already holds sk_receive_queue.lock, so it uses the new\nunlocked helper directly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npacket: sincronizar la limpieza de presi\u00f3n con la reconfiguraci\u00f3n del anillo\n\npacket_set_ring() actualiza el estado del anillo RX bajo sk_receive_queue.lock, pero sol\u00eda publicar el modo de recepci\u00f3n tpacket a trav\u00e9s de po -> prot_hook.func despu\u00e9s de liberar ese bloqueo. packet_poll() y packet_recvmsg() pueden entonces ejecutar la ruta de limpieza de presi\u00f3n despu\u00e9s de que el anillo ha sido limpiado mientras a\u00fan ven tpacket_rcv, causando que __packet_rcv_has_room() desreferencie almacenamiento de anillo obsoleto o NULL.\n\nMover la asignaci\u00f3n de gancho de recepci\u00f3n existente a la misma secci\u00f3n sk_receive_queue.lock que la actualizaci\u00f3n del estado del anillo. Mantener la asignaci\u00f3n sin cambios de otra manera, incluyendo en la reconfiguraci\u00f3n del anillo TX, para evitar a\u00f1adir cambios de comportamiento que no son necesarios para la correcci\u00f3n.\n\nSerializar la limpieza de presi\u00f3n de packet_recvmsg() con el mismo bloqueo de cola solo despu\u00e9s de que PACKET_SOCK_PRESSURE ha sido observado. Si el indicador est\u00e1 claro y el socket se ha alejado de tpacket_rcv, packet_set_ring() ya ha desvinculado el socket y esperado por synchronize_net(), por lo que ninguna nueva entrada de paquete puede establecer el indicador de nuevo.\n\npacket_poll() ya mantiene sk_receive_queue.lock, por lo que utiliza el nuevo ayudante desbloqueado directamente."}], "id": "CVE-2026-74666", "lastModified": "2026-10-16T20:17:50.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74666", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:14:12.266180Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:40.467", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a35da325cac4d5bcad76a2aa943408a6f1d9000"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c7b5eb87b2b288cdbde825f21d2b83b2f5da747"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8cfb2e71926a682f36c4240067d424074dd8f70f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a08196c3cc105947746ec21309edfbb60275fcdb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad740b4990347521f0db260d381f9f74e7b340ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf3c8e86bc8ad111be3f3136125e255344bcb3da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf8189b82bb93f219ab740e0346c919ad65ada62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f015c9de92b731814059a343b765c60c0196225c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: packet: synchronize pressure clearing with ring reconfiguration", "id": "2521363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521363"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's packet subsystem. This vulnerability occurs due to improper synchronization during ring reconfiguration, where the system can attempt to access memory that has already been freed or is invalid. This can lead to a system crash, resulting in a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-74666", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74666\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74666\nhttps://lore.kernel.org/linux-cve-announce/2026082228-CVE-2026-74666-f951@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ccdbaa6d55b0656244ba57c4b56765a0af76c0a,cf8189b82bb93f219ab740e0346c919ad65ada62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ccdbaa6d55b0656244ba57c4b56765a0af76c0a,ad740b4990347521f0db260d381f9f74e7b340ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ccdbaa6d55b0656244ba57c4b56765a0af76c0a,2c7b5eb87b2b288cdbde825f21d2b83b2f5da747)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ccdbaa6d55b0656244ba57c4b56765a0af76c0a,a08196c3cc105947746ec21309edfbb60275fcdb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2ccdbaa6d55b0656244ba57c4b56765a0af76c0a,1a35da325cac4d5bcad76a2aa943408a6f1d9000)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T19:15:03.628033+00:00", "title": "Use\u2011after\u2011free in Linux packet socket leading to kernel crash", "updated": "2026-08-25T07:45:04.231461+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}