Fedora Account System
Red Hat Associate
Red Hat Customer
packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for example through bonding device type changes. For SOCK_RAW, packet_snd() can save a larger value in reserve and later allocate headroom using a smaller value. Moving skb->data back by reserve then places it before skb->head, and the following copy from userspace can attempt an out-of-bounds write. packet_sendmsg_spkt() has the same issue because it calculates its reservation and header offset from separate reads before dropping the RCU read lock to allocate the skb. Add LL_RESERVED_SPACE_EX() for callers that already saved a header length. Read hard_header_len once in packet_snd() and use it for allocation and construction. In packet_sendmsg_spkt(), preserve the allocation-time value through the device lookup retry. The separate SOCK_DGRAM consistency problem between hard_header_len and header_ops->create is not addressed here.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:60484 https://access.redhat.com/errata/RHSA-2026:60484
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:60486 https://access.redhat.com/errata/RHSA-2026:60486
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:62609 https://access.redhat.com/errata/RHSA-2026:62609
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:63537 https://access.redhat.com/errata/RHSA-2026:63537
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:65710 https://access.redhat.com/errata/RHSA-2026:65710
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:65711 https://access.redhat.com/errata/RHSA-2026:65711
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:67721 https://access.redhat.com/errata/RHSA-2026:67721
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:67723 https://access.redhat.com/errata/RHSA-2026:67723
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:77500 https://access.redhat.com/errata/RHSA-2026:77500
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:77498 https://access.redhat.com/errata/RHSA-2026:77498
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:76738 https://access.redhat.com/errata/RHSA-2026:76738