In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in TX_RING send path
tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved headroom smaller than the amount later pushed, or make copylen - hard_header_len negative.
Snapshot hard_header_len once before processing ring frames and use it for the frame limit, headroom allocation, copy length, and skb construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.18.48-107.148Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-tools-develUpgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.18Upgrade kernel6.18-debuginfoUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-develUpgrade python3-perf6.18-debuginfoUpgrade kernel6.18-tools-debuginfoUpgrade python3-perf6.18Upgrade kernel6.18Upgrade perf6.18-debuginfoUpgrade perf6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-headersUpgrade microvm-kernel6.18Upgrade kernel6.18-modules-extra | Sep 30, 2026 | Aug 22, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution exists | Aug 25, 2026 | Aug 22, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub