Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98233

net/packet: clear RX owner on VNET header error

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed. With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet. Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < bb10a0084c03a94364aeec542beddc5d49b59f59affected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < b8c0cb3069058c2d67b5c7c833b2833381ecffdcaffected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 2daa618e7ff19eefcbda281bc4c5998c4140f9cfaffected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 23cd30498891d29a69ec9b75bd92f8a0f21f1342affected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 49a48a5aaf85fe69d2dc3fb334b4854fadf44e39affected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 805edbdcb8681da5f7ee43b3c3c809f7a8c31208affected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 693209a237fc548791cf402441db8b68d1da7d38affected
  • 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 to < 33ff111d7ba3beb86e28938d6382bb5beabd865aaffected
  • 2975472e042e0bbfeeabddc5023cb8c011ec5a07affected
  • 6fb0e4385928900ccb8697748555b3f54bba5193affected
  • 86137342fd4cf52882842aa8d1318b2661f08e8aaffected
  • b06e4d3ed4044c2facf10a511d809f9aa29d960eaffected
  • 4.14.175 to < 4.15affected
  • 4.19.114 to < 4.20affected
  • 5.4.29 to < 5.5affected
  • 5.5.14 to < 5.6affected

Linux Linux

Default version status: affected

  • 5.6affected
  • 0 to < 5.6unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References