net: qualcomm: rmnet: restore skb->dev on deaggregated frames

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89780
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-16 09:17:08 UTC
Updated2026-09-16 09:17:08 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 9b78ab84ddf97c06a8567edb62b6c0fd582f9a62 git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 9d18c6c6cd1666b2cb7915cad052e22abf520997 git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 4bcef54e4a3355a62d9ad90729fe563435ec76c3 git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c b14c22c31d9e30f38ea1693ac06d318f32258f5d git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 7abe769e72c792e5f9eb273813eb3ecd8389854c git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c 200460a0793dc6af97d3b36d92ac245350ac26fc git Not specified
CNA Linux Linux affected 378e25357ac78ad02fbc98bec9b4e3baaa916c5c a66734a1c5e36525ea07e9f4547fddc51e916de3 git Not specified
CNA Linux Linux affected 4.17 Not specified
CNA Linux Linux unaffected 4.17 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4bcef54e4a3355a62d9ad90729fe563435ec76c3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9d18c6c6cd1666b2cb7915cad052e22abf520997 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a66734a1c5e36525ea07e9f4547fddc51e916de3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b14c22c31d9e30f38ea1693ac06d318f32258f5d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/200460a0793dc6af97d3b36d92ac245350ac26fc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7abe769e72c792e5f9eb273813eb3ecd8389854c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9b78ab84ddf97c06a8567edb62b6c0fd582f9a62 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report