The Linux kernel's packet_parse_headers() function only reset the MAC header for SOCK_RAW frames without a bound protocol, leaving it unset for protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and legacy SOCK_PACKET paths. While __dev_queue_xmit() resets the MAC header unconditionally, the PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not reset the MAC header. This leads to frames reaching ndo_start_xmit() with an unset MAC header. Drivers that read eth_hdr(skb) on transmit then dereference an out-of-bounds memory location approximately 64 KiB past the skb->head, causing a memory safety issue. The fix was to reset the MAC header unconditionally on the bypass path, mirroring __dev_queue_xmit().

The vulnerability can cause out-of-bounds memory access during packet transmission in affected Linux kernel versions, potentially leading to memory corruption or kernel crashes. No known exploits in the wild have been reported. The issue affects the kernel's packet-socket transmit path and could impact network drivers that read the MAC header on transmit.

A fix has been implemented in the Linux kernel to reset the MAC header unconditionally on the packet-socket transmit path, preventing the out-of-bounds access. Users should apply the official kernel updates containing this fix once available. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.