CVE-2026-98375
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN. If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead. Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced
References
- https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5
- https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801
- https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40
- https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067
- https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e