CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/packet: avoid fanout hook re-registration after unregister

packet_set_ring() temporarily detaches a socket from packet delivery while
reconfiguring its ring. It records the previous running state, clears
po->num, unregisters the protocol hook when needed, drops po->bind_lock,
and later restores po->num and re-registers the hook from the saved
was_running value.

That unlocked window can race with NETDEV_UNREGISTER. The notifier can
observe the socket as not running, skip __unregister_prot_hook(), and
invalidate the per-socket binding by setting po->ifindex to -1 and clearing
po->prot_hook.dev. A one-member fanout group can still retain its shared
fanout hook device pointer. When packet_set_ring() resumes, re-registering
solely from the stale was_running state can re-add the fanout hook after
the device has been unregistered.

Treat po->ifindex == -1 as an invalidated binding after reacquiring
po->bind_lock. This is distinct from ifindex 0, the normal
unbound/wildcard state: ifindex -1 marks an existing device binding that
was invalidated when the device was unregistered. Restore po->num as
before, but do not re-register the hook if device unregister already
detached the socket.

The Linux kernel CVE team has assigned CVE-2026-68338 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.1 with commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc and fixed in 6.6.148 with commit 80ec024d53a05c60ad1d08968dcf745f10c1665c
	Issue introduced in 3.1 with commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc and fixed in 6.12.101 with commit 0a052e0808e015e68144a9877e6ef42b952c49fa
	Issue introduced in 3.1 with commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc and fixed in 6.18.42 with commit 1bc55c29cd85818e9052f17deb287d5a11fb817f
	Issue introduced in 3.1 with commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc and fixed in 7.1.6 with commit a885387dae7986a55bae5c77a15bdd447f64e9b9
	Issue introduced in 3.1 with commit dc99f600698dcac69b8f56dda9a8a00d645c5ffc and fixed in 7.2-rc5 with commit 50aff80475abd3533eef4320477037e6fcc6b56e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68338
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/packet/af_packet.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/80ec024d53a05c60ad1d08968dcf745f10c1665c
	https://git.kernel.org/stable/c/0a052e0808e015e68144a9877e6ef42b952c49fa
	https://git.kernel.org/stable/c/1bc55c29cd85818e9052f17deb287d5a11fb817f
	https://git.kernel.org/stable/c/a885387dae7986a55bae5c77a15bdd447f64e9b9
	https://git.kernel.org/stable/c/50aff80475abd3533eef4320477037e6fcc6b56e