Cloudanix VulnDB

CVE-2026-98377

None

CVSS

—

EPSS

0.2%

Published

Oct 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of VLAN tags on certain network devices can let specially crafted network packets carry pieces of internal kernel memory, potentially exposing sensitive information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The __vlan_insert_inner_tag() helper rewrites the first 16 bytes of an skb without first ensuring a MAC header of at least ETH_HLEN bytes is present; on devices with hard_header_len==0 (such as IFF_TUN) an attacker-supplied short frame causes the helper to copy uninitialized slab memory into the packet that is then transmitted.

Why it matters to the business

Attackers may obtain kernel memory contents containing addresses and other sensitive data from network traffic, increasing the risk of information leakage on Linux systems that process VLAN-tagged frames from untrusted sources.

How an attack unfolds

An attacker crafts a one-byte AF_PACKET/SOCK_RAW frame on a TUN device, then triggers repeated VLAN push operations (via clsact actions or bpf_skb_vlan_push) so that each push pulls bytes from beyond skb->tail; after three pushes the transmitted frame contains 11 bytes of uninitialized slab data.

How to fix it

Upgrade to a kernel containing the fix that adds an explicit MAC-header presence check inside __vlan_insert_inner_tag() before any header rewriting occurs.

How to confirm the fix worked

Confirm the presence of the MAC-header guard in __vlan_insert_inner_tag() by inspecting the kernel source or running a targeted regression test that sends undersized frames through VLAN push paths and verifies they are dropped.

Typical attack path

  1. Create or attach to an IFF_TUN interface
  2. Send a minimal one-byte raw Ethernet frame via AF_PACKET/SOCK_RAW
  3. Apply one or more VLAN push actions through tc, BPF, or skb_vlan_push
  4. Observe the resulting larger frame that now carries slab memory contents

How to detect it

Review network capture logs and kernel skb traces for frames whose length exceeds what was originally sent and that contain non-zero data in positions that were never written by the sending process; correlate with processes using raw sockets or BPF VLAN actions.

What your security team should do

  • Apply the upstream fix as soon as a distribution package becomes available
  • Monitor EPSS and exploit maturity indicators for any rise in activity
  • Restrict unprivileged use of AF_PACKET on systems that expose TUN or similar interfaces

The record

In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in __vlan_insert_inner_tag() __vlan_insert_inner_tag() only guarantees head room via skb_cow_head(), never that mac_len bytes of MAC header are present. Its ETH_HLEN wrappers - __vlan_insert_tag() under skb_vlan_push(), and vlan_insert_tag() under validate_xmit_vlan() on the generic transmit path - therefore rewrite the first 16 bytes at skb->data: a 12-byte memmove plus two 2-byte stores at +12 and +14. No caller supplies the bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull(). An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a hwaccel tag; the next - clsact "action vlan push" or bpf_skb_vlan_push() - enters the helper with skb->len still 1. The head comes from skbuff_small_head without __GFP_ZERO, so each push drags bytes from beyond skb->tail into the frame. After three the one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised slab: 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81 `------------------------------' only 0x5a was sent; the rest is slab, here the top 56 bits of a linear-map address Require the MAC header the helper rewrites to be present, so such a frame is dropped rather than transmitted.

Affected packages

Ecosystem Package Introduced Fixed