In the Linux kernel, the following vulnerability has been resolved:

packet: use consistent hard_header_len in non-ring send paths

packet_snd() reads dev->hard_header_len multiple times while allocating
and constructing an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.

For SOCK_RAW, packet_snd() can save a larger value in reserve and later
allocate headroom using a smaller value. Moving skb->data back by reserve
then places it before skb->head, and the following copy from userspace can
attempt an out-of-bounds write.

packet_sendmsg_spkt() has the same issue because it calculates its
reservation and header offset from separate reads before dropping the RCU
read lock to allocate the skb.

Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
Read hard_header_len once in packet_snd() and use it for allocation and
construction. In packet_sendmsg_spkt(), preserve the allocation-time value
through the device lookup retry.

The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.

https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d

https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec

https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed

https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0

https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/netdevice.h","net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"91f041451f967cd87ed722a8f43c0b767a64f1a0","versionType":"git","status":"affected"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"9052756290962ffb9a661bcf319e92dedaaedfed","versionType":"git","status":"affected"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"5bb10753d428aadfc356a2bfe9acea09c82a62ec","versionType":"git","status":"affected"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"b06b6fce6d7deaf7238e09b48ce3b1125ff41acd","versionType":"git","status":"affected"},{"version":"b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba","lessThan":"03390aa32e669cc4ecd7d34108e2e1afc13d689d","versionType":"git","status":"affected"},{"version":"d9fb8cc230b2a4757e9fe4f81468f81212d4deaa","versionType":"git","status":"affected"},{"version":"6190cce26e40bf71c4d375b21eea74bb07b6a0f3","versionType":"git","status":"affected"},{"version":"01a658c1b9d4b5393c38d5a92d9112ab1425382a","versionType":"git","status":"affected"},{"version":"8809ae6747e760e6f1d2453ceb08c9bcc4939766","versionType":"git","status":"affected"},{"version":"4.4.133","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.103","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.44","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.16.12","lessThan":"4.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/netdevice.h","net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]