CVE-2026-74582

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> packet: use consistent hard_header_len in non-ring send paths<br /> <br /> packet_snd() reads dev-&gt;hard_header_len multiple times while allocating<br /> and constructing an skb. Device reconfiguration can change this value<br /> concurrently, for example through bonding device type changes.<br /> <br /> For SOCK_RAW, packet_snd() can save a larger value in reserve and later<br /> allocate headroom using a smaller value. Moving skb-&gt;data back by reserve<br /> then places it before skb-&gt;head, and the following copy from userspace can<br /> attempt an out-of-bounds write.<br /> <br /> packet_sendmsg_spkt() has the same issue because it calculates its<br /> reservation and header offset from separate reads before dropping the RCU<br /> read lock to allocate the skb.<br /> <br /> Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.<br /> Read hard_header_len once in packet_snd() and use it for allocation and<br /> construction. In packet_sendmsg_spkt(), preserve the allocation-time value<br /> through the device lookup retry.<br /> <br /> The separate SOCK_DGRAM consistency problem between hard_header_len and<br /> header_ops-&gt;create is not addressed here.