Look up another CVE · open CVE-2026-74666 in the interactive tracker
CVE-2026-74666
packet: synchronize pressure clearing with ring reconfiguration
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem net/packet. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74666 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() and packet_recvmsg() can then run the pressure clearing path after the ring has been cleared while still seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference stale or NULL ring storage. Move the existing receive hook assignment into the same sk_receive_queue.lock section as the ring state update. Keep the assignment otherwise unchanged, including on TX ring reconfiguration, to avoid adding behavior changes that are not required for the fix. Serialize packet_recvmsg() pressure clearing with the same queue lock only after PACKET_SOCK_PRESSURE has been observed. If the flag is clear and the socket has moved away from tpacket_rcv, packet_set_ring() has already detached the socket and waited for synchronize_net(), so no new packet input can set the flag again. packet_poll() already holds sk_receive_queue.lock, so it uses the new unlocked helper directly.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/packet/af_packet.c
- What this is
- PACKET SOCKETSMAINTAINERS section matched on net/packet/af_packet.c · Maintained
Check it on the machine
grep -w CONFIG_PACKET /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_PACKET
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/packet
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.2 | 5.10.267 | bf3c8e86bc8a |
| 4.2 | 5.15.218 | 8cfb2e71926a |
| 4.2 | 6.1.185 | f015c9de92b7 |
| 4.2 | 6.6.152 | cf8189b82bb9 |
| 4.2 | 6.12.104 | ad740b499034 |
| 4.2 | 6.18.45 | 2c7b5eb87b2b |
| 4.2 | 7.1.9 | a08196c3cc10 |
| 4.2 | 7.2 | 1a35da325cac |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is hit only from local AF_PACKET syscalls—setsockopt(PACKET_RX_RING) racing poll(2)/recvmsg(2) pressure clearing in packet_poll()/packet_recvmsg()—not from remote packet receive paths like ksmbd, nfsd, or the TCP/IP stack.
- AC:LAttack complexity, low
- The attacker controls both race sides: one thread polls/recvmsg while PACKET_SOCK_PRESSURE is set, another tears down the RX ring via PACKET_RX_RING; packet_set_ring()'s synchronize_net() window makes the stale tpacket_rcv vs NULL/freed pg_vec mismatch reliably winnable.
- PR:LPrivileges required, low
- packet_create() requires ns_capable(net->user_ns, CAP_NET_RAW); unprivileged users obtain CAP_NET_RAW via user+network namespaces (unshare -Urn) or container defaults (Docker NET_RAW), without init-namespace root.
- UI:NUser interaction, none
- No victim action is required; the attacker creates the AF_PACKET socket, configures the mmap RX ring, fills it to set PACKET_SOCK_PRESSURE, and races ring teardown against its own poll/recvmsg calls.
- S:UScope, unchanged
- Stale/NULL ring dereferences corrupt kernel heap state on the same host; this is standard kernel memory corruption within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary scope change.
- C:HConfidentiality impact, high
- __packet_rcv_has_room() follows tpacket_rcv and dereferences rb->pg_vec or prb_bdqc block pointers after packet_set_ring() cleared/freed the ring, yielding NULL-dereference or use-after-free reads of ring metadata and mmap-backed pages.
- I:HIntegrity impact, high
- Freed ring storage and stale prb_bdqc/pkbdq pointers remain attacker-influenced through mmap and concurrent ring operations, providing a controllable kernel heap use-after-free write primitive typical of AF_PACKET ring reconfiguration races.
- A:HAvailability impact, high
- NULL pg_vec indexing in packet_lookup_frame() or stale block access in prb_lookup_block() from the pressure-clearing path causes an immediate kernel oops/panic, giving any qualifying local attacker repeatable host-wide denial of service.