CVE-2026-74668

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> packet: use consistent hard_header_len in TX_RING send path<br /> <br /> tpacket_snd() reads dev-&gt;hard_header_len independently for skb<br /> allocation and header construction in tpacket_fill_skb(). Concurrent<br /> netdevice reconfiguration can therefore make the reserved headroom<br /> smaller than the amount later pushed, or make copylen - hard_header_len<br /> negative.<br /> <br /> Snapshot hard_header_len once before processing ring frames and use it<br /> for the frame limit, headroom allocation, copy length, and skb<br /> construction. Pass the snapshot to tpacket_fill_skb().<br /> <br /> The separate SOCK_DGRAM consistency problem between hard_header_len and<br /> header_ops-&gt;create is not addressed here.