CVE-2026-99033— net/packet: guard the ll header push in packet_rcv_spkt()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： net/packet: 在 packet_rcv_spkt() 中对链路层头部推送操作增加保护 函数通过以下代码恢复链路层头部： 然而，该减法运算仅在设备实际拥有链路层头部时才有意义。 和 均通过 对该操作进行了封装保护，且文件顶部的块注释也明确指出恢复操作应基于该谓词；但 却未包含此保护。 提交 d549699048b4（"net/packet: 修复在无可见硬头部的 L3 设备上接收数据包的问题"）引入了该辅助函数并修改了两个调用点，但遗漏了 这一处。 对于没有可见
Possible ATT&CK Techniques 1 AI
T1499.003 · Application Exhaustion FloodAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | d549699048b4b5c22dd710455bcdb76966e55aa3< d8a24b9e1774a93943caf68d48c5e17be432220b |
affected |
d549699048b4b5c22dd710455bcdb76966e55aa3< 31c7b15b3716e8d0dad58d2c3cdf321dfd06f4be |
affected | ||
d549699048b4b5c22dd710455bcdb76966e55aa3< 3efe0e0944157fdd2072b4dc7eb0491a317ed272 |
affected | ||
d549699048b4b5c22dd710455bcdb76966e55aa3< 00fbf71e74115f7628fc0880b855434b1e70c40c |
affected | ||
d549699048b4b5c22dd710455bcdb76966e55aa3< 28bc1ef699610ee09ce3d46a00552f5a0a0144bd |
affected | ||
dadddde259a19105ee69e788835f4d4552767aa9 |
affected | ||
5.9.13< 5.10 |
affected | ||
5.10 |
affected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99033
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/packet: guard the ll header push in packet_rcv_spkt()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/packet: guard the ll header push in packet_rcv_spkt()
packet_rcv_spkt() restores the link layer header with
skb_push(skb, skb->data - skb_mac_header(skb));
That subtraction is only meaningful when the device actually has a link
layer header. packet_rcv() and tpacket_rcv() both wrap it in
dev_has_header(), which is also the predicate the block comment at the
top of the file states the restore in terms of; packet_rcv_spkt() does
not. commit d549699048b4 ("net/packet: fix packet receive on L3
devices without visible hard header") introduced the helper and changed
the two call sites, and this one stayed behind.
A device without a visible ll header can leave skb->mac_header at the
0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does:
init_can_skb() sets pkt_type and ip_summed but does not reset the
headers, and commit 9f10374bb024 ("can: remove private CAN skb
headroom infrastructure") dropped the skb_reset_*_header() calls that
used to be there. skb_mac_header() is then 0xFFFF, the length becomes
a large negative number and skb_push() reports it through
skb_under_panic() -- from softirq context, so it is a full system panic
even with panic_on_oops=0:
skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0
kernel BUG at net/core/skbuff.c:214!
RIP: 0010:skb_panic+0x50/0x60
Call Trace:
<IRQ>
skb_push+0x38/0x40
packet_rcv_spkt+0xe1/0x170
__netif_receive_skb_core.constprop.0+0x7e8/0xd30
...
Kernel panic - not syncing: Fatal exception in interrupt
The socket type is reachable: packet_create() accepts SOCK_PACKET
alongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check,
and neither the socket length nor a capability check keeps it away
from a CAN interface.
The missing skb_reset_*_header() calls in init_can_skb() are a
regression in their own right and are being fixed separately, but a
packet socket should not turn a link layer that did not initialise its
mac header into a kernel panic. Guard the push the way the other two
receive paths do.
Tested on v7.3-rc5 under QEMU with a slcan device on a pty, which is
the driver RX path: vcan does not reproduce it, because can_send()
resets the headers on the way out. One SOCK_PACKET socket bound to
can0 and one frame written into the line discipline panics an
unpatched kernel with the trace above; the same image with this patch
prints no panic and powers off normally. Both kernels are this tree,
defconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99033
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99033
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-99033 (5)
Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total
| CVE-2026-98959 | 9.8 CRITICAL | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-99078 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-99079 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-98988 | 8.8 HIGH | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE |
| CVE-2026-99083 | 8.8 HIGH | ksmbd: fix heap out-of-bounds write in krb5_authenticate() |
| CVE-2026-99082 | 8.8 HIGH | KVM: x86: Use active memslots for the per-vCPU MMIO cache |
| CVE-2026-98981 | 8.8 HIGH | namespace: unhash a dentry before detaching the mounts on it |
| CVE-2026-98980 | 8.8 HIGH | namei: don't reveal overmounted entries in refwalk |
| CVE-2026-98870 | 8.8 HIGH | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-98978 | 8.4 HIGH | namespace: never expire a locked mount |
| CVE-2026-99042 | 8.4 HIGH | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 |
| CVE-2026-98968 | 8.1 HIGH | amt: send the relay's General Query directly from the receive path |
| CVE-2026-99064 | 8.1 HIGH | cipso: adjust cached option offsets when removing CIPSO |
| CVE-2026-99014 | 7.8 HIGH | Bluetooth: hci_sync: Fix command skb lifetime during scan setup |
| CVE-2026-98999 | 7.8 HIGH | drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin |
| CVE-2026-99016 | 7.8 HIGH | riscv: futex: untag the user pointer before the atomic access |
| CVE-2026-99018 | 7.8 HIGH | riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp |
| CVE-2026-99051 | 7.8 HIGH | fsverity: RCU-delay the freeing of struct fsverity_info |
| CVE-2026-99054 | 7.8 HIGH | tipc: destroy topsrv workqueues before closing connections |
| CVE-2026-99053 | 7.8 HIGH | tipc: hold a reference to nodes found by link name |
Showing top 20 of 217 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99099
x86/CPU/AMD: Fix AMD TLBI Erratum #1718 -
CVE-2026-99097
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc -
CVE-2026-99098
dm-integrity: fix buffer overflow in inline mode with large -
CVE-2026-99095
drm/vc4: drain the hangcheck timer and works on V3D unbind -
CVE-2026-99096
io_uring/register: don't exempt disabled rings from task res
Same vendor: Linux
-
CVE-2026-99099
x86/CPU/AMD: Fix AMD TLBI Erratum #1718 -
CVE-2026-99097
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc -
CVE-2026-99098
dm-integrity: fix buffer overflow in inline mode with large -
CVE-2026-99095
drm/vc4: drain the hangcheck timer and works on V3D unbind -
CVE-2026-99096
io_uring/register: don't exempt disabled rings from task res