The Linux kernel vulnerability CVE-2026-74668 concerns inconsistent use of the hard_header_len parameter in the TX_RING send path within the packet subsystem. Specifically, tpacket_snd() reads dev->hard_header_len separately for socket buffer allocation and header construction, which can lead to a mismatch if the network device is reconfigured concurrently. This mismatch can cause the reserved headroom to be smaller than required or result in negative values for copylen - hard_header_len, potentially leading to memory corruption or instability. The patch addresses this by snapshotting the hard_header_len value once before processing ring frames and consistently using this snapshot for frame limits, headroom allocation, copy length, and skb construction. The advisory notes that a related consistency issue between hard_header_len and header_ops->create remains unaddressed.

The vulnerability could cause incorrect memory handling during packet transmission in the Linux kernel, potentially leading to memory corruption or kernel instability when network devices are reconfigured concurrently. No specific exploitation details or active exploits are reported. The impact is limited to kernel packet processing and could affect system stability or security depending on usage context.

A fix has been implemented that snapshots the hard_header_len value once before processing ring frames and uses this consistent value throughout the packet transmission path. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. Since no patch links or vendor advisory are provided here, check the official Linux kernel repositories or trusted vendor advisories for the updated kernel version containing this fix.