CVE-2026-68338
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A timing flaw in Linux networking code could let someone already on the system crash it or gain higher privileges by interfering with network device changes.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in Linux kernel net/packet allowing packet_set_ring() to re-register a fanout hook after NETDEV_UNREGISTER has invalidated the binding by setting ifindex to -1.
Why it matters to the business
Local attackers on Linux systems can trigger kernel instability or memory corruption leading to crashes or potential privilege escalation, increasing risk of system compromise.
How an attack unfolds
An attacker with local access concurrently performs packet ring reconfiguration while triggering network device unregistration to exploit the unlocked window between hook unregister and re-register, resulting in use of a stale fanout hook on a detached device.
How to fix it
Apply the upstream kernel patch that treats ifindex == -1 as an invalidated binding and skips hook re-registration after device detach; rebuild and reboot with the fixed kernel.
How to confirm the fix worked
Confirm the kernel source includes the check for po->ifindex == -1 before re-registering the protocol hook in packet_set_ring after reacquiring bind_lock.
Typical attack path
- Obtain local user access
- Create packet sockets using fanout groups
- Perform ring reconfiguration via packet_set_ring while forcing NETDEV_UNREGISTER
- Trigger the race to retain invalid hook state
- Leverage resulting corruption for escalation or denial of service
How to detect it
Review kernel logs for oops, warnings, or panics referencing packet fanout or prot_hook around device unregister events; inspect for unexpected socket ring operations coinciding with interface removal.
What your security team should do
- Prioritize kernel updates on all Linux hosts
- Limit unprivileged local access to systems running affected kernels
- Test patched kernels in staging before broad deployment
- Monitor distribution advisories for backported fixes
The record
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po->num, unregisters the protocol hook when needed, drops po->bind_lock, and later restores po->num and re-registers the hook from the saved was_running value. That unlocked window can race with NETDEV_UNREGISTER. The notifier can observe the socket as not running, skip __unregister_prot_hook(), and invalidate the per-socket binding by setting po->ifindex to -1 and clearing po->prot_hook.dev. A one-member fanout group can still retain its shared fanout hook device pointer. When packet_set_ring() resumes, re-registering solely from the stale was_running state can re-add the fanout hook after the device has been unregistered. Treat po->ifindex == -1 as an invalidated binding after reacquiring po->bind_lock. This is distinct from ifindex 0, the normal unbound/wildcard state: ifindex -1 marks an existing device binding that was invalidated when the device was unregistered. Restore po->num as before, but do not re-register the hook if device unregister already detached the socket.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|