net/packet: guard the ll header push in packet_rcv_spkt()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99033
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:26 UTC
Updated2026-10-23 13:17:26 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That subtraction is only meaningful when the device actually has a link layer header. packet_rcv() and tpacket_rcv() both wrap it in dev_has_header(), which is also the predicate the block comment at the top of the file states the restore in terms of; packet_rcv_spkt() does not. commit d549699048b4 ("net/packet: fix packet receive on L3 devices without visible hard header") introduced the helper and changed the two call sites, and this one stayed behind. A device without a visible ll header can leave skb->mac_header at the 0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does: init_can_skb() sets pkt_type and ip_summed but does not reset the headers, and commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") dropped the skb_reset_*_header() calls that used to be there. skb_mac_header() is then 0xFFFF, the length becomes a large negative number and skb_push() reports it through skb_under_panic() -- from softirq context, so it is a full system panic even with panic_on_oops=0: skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0 kernel BUG at net/core/skbuff.c:214! RIP: 0010:skb_panic+0x50/0x60 Call Trace: <IRQ> skb_push+0x38/0x40 packet_rcv_spkt+0xe1/0x170 __netif_receive_skb_core.constprop.0+0x7e8/0xd30 ... Kernel panic - not syncing: Fatal exception in interrupt The socket type is reachable: packet_create() accepts SOCK_PACKET alongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check, and neither the socket length nor a capability check keeps it away from a CAN interface. The missing skb_reset_*_header() calls in init_can_skb() are a regression in their own right and are being fixed separately, but a packet socket should not turn a link layer that did not initialise its mac header into a kernel panic. Guard the push the way the other two receive paths do. Tested on v7.3-rc5 under QEMU with a slcan device on a pty, which is the driver RX path: vcan does not reproduce it, because can_send() resets the headers on the way out. One SOCK_PACKET socket bound to can0 and one frame written into the line discipline panics an unpatched kernel with the trace above; the same image with this patch prints no panic and powers off normally. Both kernels are this tree, defconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d549699048b4b5c22dd710455bcdb76966e55aa3 d8a24b9e1774a93943caf68d48c5e17be432220b git Not specified
CNA Linux Linux affected d549699048b4b5c22dd710455bcdb76966e55aa3 31c7b15b3716e8d0dad58d2c3cdf321dfd06f4be git Not specified
CNA Linux Linux affected d549699048b4b5c22dd710455bcdb76966e55aa3 3efe0e0944157fdd2072b4dc7eb0491a317ed272 git Not specified
CNA Linux Linux affected d549699048b4b5c22dd710455bcdb76966e55aa3 00fbf71e74115f7628fc0880b855434b1e70c40c git Not specified
CNA Linux Linux affected d549699048b4b5c22dd710455bcdb76966e55aa3 28bc1ef699610ee09ce3d46a00552f5a0a0144bd git Not specified
CNA Linux Linux affected dadddde259a19105ee69e788835f4d4552767aa9 git Not specified
CNA Linux Linux affected 5.9.13 5.10 semver Not specified
CNA Linux Linux affected 5.10 Not specified
CNA Linux Linux unaffected 5.10 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.57 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.11 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/28bc1ef699610ee09ce3d46a00552f5a0a0144bd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/00fbf71e74115f7628fc0880b855434b1e70c40c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3efe0e0944157fdd2072b4dc7eb0491a317ed272 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d8a24b9e1774a93943caf68d48c5e17be432220b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/31c7b15b3716e8d0dad58d2c3cdf321dfd06f4be 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report