CVE-2026-74582 (GCVE-0-2026-74582)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-27 12:39
VLAI
Title
packet: use consistent hard_header_len in non-ring send paths
Summary
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812 (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 78a47127e33c340bc6d38dcc4552a094b4f5cc77 (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 142e287b3a25cfe909215177c23243e7fc5ae2b1 (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 91f041451f967cd87ed722a8f43c0b767a64f1a0 (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 9052756290962ffb9a661bcf319e92dedaaedfed (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 5bb10753d428aadfc356a2bfe9acea09c82a62ec (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < b06b6fce6d7deaf7238e09b48ce3b1125ff41acd (git)
Affected: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba , < 03390aa32e669cc4ecd7d34108e2e1afc13d689d (git)
Affected: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa (git)
Affected: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 (git)
Affected: 01a658c1b9d4b5393c38d5a92d9112ab1425382a (git)
Affected: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 (git)
Affected: 4.4.133 , < 4.5 (semver)
Affected: 4.9.103 , < 4.10 (semver)
Affected: 4.14.44 , < 4.15 (semver)
Affected: 4.16.12 , < 4.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.10.267 , ≤ 5.10.* (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
              "status": "affected",
              "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.133",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.133",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:47.499Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
        },
        {
          "url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
        },
        {
          "url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
        },
        {
          "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
        }
      ],
      "title": "packet: use consistent hard_header_len in non-ring send paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74582",
    "datePublished": "2026-08-21T16:31:55.283Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-27T12:39:47.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74582",
      "date": "2026-09-21",
      "epss": "0.0012",
      "percentile": "0.0212"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:58:04.000Z",
      "cve": "CVE-2026-74582",
      "id": "msrc_CVE-2026-74582",
      "initial_release_date": "2026-08-23T01:03:14.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "packet: use consistent hard_header_len in non-ring send paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74582.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netdevice.h",
                  "net/packet/af_packet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
                    "status": "affected",
                    "version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.5",
                    "status": "affected",
                    "version": "4.4.133",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "affected",
                    "version": "4.9.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "affected",
                    "version": "4.16.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netdevice.h",
                  "net/packet/af_packet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.267",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.218",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.185",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
          }
        ],
        "id": "CVE-2026-74582",
        "lastModified": "2026-08-27T13:18:34.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-21T17:16:44.507",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-16T11:44:29+00:00",
      "cve": "CVE-2026-74582",
      "id": "CVE-2026-74582",
      "initial_release_date": "2026-08-05T12:00:00+00:00",
      "product_status:fixed": "1218",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: packet: use consistent hard_header_len in non-ring send paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74582.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:26:16Z",
      "cve": "CVE-2026-74582",
      "id": "CVE-2026-74582",
      "initial_release_date": "2026-08-22T00:52:33Z",
      "product_status:first_fixed": "127",
      "product_status:known_affected": "715",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74582",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74582.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.