{"api_version":"1","generated_at":"2026-08-22T18:40:14+00:00","cve":"CVE-2026-74667","urls":{"html":"https://cve.report/CVE-2026-74667","api":"https://cve.report/api/cve/CVE-2026-74667.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74667","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74667"},"summary":{"title":"net/packet: reset the MAC header on the packet-socket transmit path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb->mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb->data\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-22 16:16:40","updated_at":"2026-08-22 16:16:40"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231","name":"https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d","name":"https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f","name":"https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681","name":"https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae","name":"https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e","name":"https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a","name":"https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30","name":"https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74667","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74667","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 1e43a1d66615f411d427f9df1f46dd049d9e3681 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 4057853a91fb796c4f47c7d1baf1aa085394148e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 2610ed4e86a4590234a9d70518c469751c5af231 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 b47ba8fe6e1d2df8c92048de5afafd059447dc30 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 971aa7d99242bbf09513e27b7a243f0b29ff23ae git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 fdd4d7d52358a58e351dd9d82530c04eba8ccd7a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 75c65772c3d18447d62d3aca5f91b06c16cc25e4 c2707480cfbf19c7619acc9c089d17f20869821f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.265 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.216 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.183 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.152 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.104 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.45 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.9 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1e43a1d66615f411d427f9df1f46dd049d9e3681","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"4057853a91fb796c4f47c7d1baf1aa085394148e","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"2610ed4e86a4590234a9d70518c469751c5af231","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"b47ba8fe6e1d2df8c92048de5afafd059447dc30","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"971aa7d99242bbf09513e27b7a243f0b29ff23ae","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"fdd4d7d52358a58e351dd9d82530c04eba8ccd7a","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"},{"lessThan":"c2707480cfbf19c7619acc9c089d17f20869821f","status":"affected","version":"75c65772c3d18447d62d3aca5f91b06c16cc25e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.152","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.104","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.45","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.265","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.216","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.183","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.152","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.104","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.45","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.9","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb->mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb->data\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested."}],"providerMetadata":{"dateUpdated":"2026-08-22T15:32:38.862Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681"},{"url":"https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e"},{"url":"https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231"},{"url":"https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30"},{"url":"https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d"},{"url":"https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae"},{"url":"https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a"},{"url":"https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f"}],"title":"net/packet: reset the MAC header on the packet-socket transmit path","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74667","datePublished":"2026-08-22T15:32:38.862Z","dateReserved":"2026-08-15T05:44:03.924Z","dateUpdated":"2026-08-22T15:32:38.862Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-22 16:16:40","lastModifiedDate":"2026-08-22 16:16:40","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74667","Ordinal":"1","Title":"net/packet: reset the MAC header on the packet-socket transmit p","CVE":"CVE-2026-74667","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74667","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb->mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb->data\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested.","Type":"Description","Title":"net/packet: reset the MAC header on the packet-socket transmit p"}]}}}