kernel: packet: use consistent hard_header_len in non-ring send paths

An out-of-bounds write problem was observed in packetsendmsgspkt in net/packet/afpacket.c in the Linux Kernel. In this flaw, AFPACKET hardheaderlen race may allow local privilege escalation...

CVE-2026-80841

A flaw was found in the Linux kernel's net/packet component, specifically within the AFPACKET transmission ring. This vulnerability occurs because virtual memory allocated for network packet handling is prematurely released while active network buffers socket kernel buffers, or skbs still hold...

CVE-2026-98233

The Linux kernel contains a vulnerability in net/packet where the tpacket_rcv() function fails to release a claimed V1 or V2 ring slot if the virtio-net header conversion fails. This error path leaves the ownership bit set, which can cause an issue where an unsupported UDP GSO packet renders the ...

EUVD-2026-93161

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

CVE-2026-98233

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

PT-2026-106562

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacket rcv: avoid a producer race condition" added rx owner map and made tpacket rcv claim a V1 or V2 ring slot before converting the virtio-net...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/packet: a race condition in packetsetring and packetnotifier has been fixed. When packetsetring releases po-bindlock, another thread may execute packetnotifier and process an NETDEVUP event. This race condition is similar to...

SUSE CVE-2026-80841

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

CVE-2026-80841

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

Linux Distros Unpatched Vulnerability : CVE-2026-80906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called ...

CVE-2026-80841: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

PT-2026-91303

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX RING free until skbs finish AF PACKET TX RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg vec is freed, but they do not preserve a...

Linux Distros Unpatched Vulnerability : CVE-2026-80841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backe...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

Linux Distros Unpatched Vulnerability : CVE-2026-74667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind ...

net/packet: avoid fanout hook re-registration after unregister

...

CVE-2026-68338

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...

CVE-2026-68338

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...