Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98375

xen/netfront: drop RX packets with a short Ethernet header

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN. If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead. Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0d160211965b79de989cf2d170985abeb8da5ec6 to < 0542d213253eec18785a24b603b28bd385dfe4a5affected
  • 0d160211965b79de989cf2d170985abeb8da5ec6 to < 236a17caebcff31f75bec5ff4136bde2de944e40affected
  • 0d160211965b79de989cf2d170985abeb8da5ec6 to < 72d2f54367895d6e236b9857892e2e6b6036e067affected
  • 0d160211965b79de989cf2d170985abeb8da5ec6 to < e2b721bc30f40ffa7ccc36a56d4e8990b8c0538eaffected
  • 0d160211965b79de989cf2d170985abeb8da5ec6 to < 089e58805c452e52179482b1025a8e309a57f801affected

Linux Linux

Default version status: affected

  • 2.6.23affected
  • 0 to < 2.6.23unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.56 to ≤ 6.18.*unaffected
  • 7.2.10 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References