Cloudanix VulnDB

CVE-2026-98526

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's network code can cause memory problems when certain older network protocols run over virtual LAN connections, potentially crashing servers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

llc_alloc_frame() fails to reserve sufficient skb headroom for stacked devices such as VLANs, allowing eth_header() to underflow the allocated buffer when writing the Ethernet header.

Why it matters to the business

Systems using LLC over VLAN or similar stacked Ethernet interfaces risk kernel memory corruption or crashes, potentially causing network service outages or requiring emergency reboots on affected Linux hosts.

How an attack unfolds

An attacker configures or triggers an LLC response frame on a VLAN-tagged interface; the insufficient headroom reservation causes skb underflow during header construction, leading to memory corruption that may be leveraged for denial of service or further exploitation depending on kernel configuration and mitigations.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the device-type check with LL_RESERVED_SPACE() to correctly account for stacked device headroom requirements.

How to confirm the fix worked

Confirm the presence of the upstream commit that introduces LL_RESERVED_SPACE() usage in llc_alloc_frame(); test by creating VLAN interfaces and exercising LLC frame allocation paths under load.

Typical attack path

  1. Identify or create a Linux host with LLC enabled over a VLAN or stacked Ethernet device
  2. Send network traffic that elicits an LLC protocol response
  3. Trigger llc_alloc_frame() followed by eth_header() on the stacked device
  4. Cause skb headroom underflow resulting in memory corruption

How to detect it

Search kernel logs for skb headroom underflow warnings, LLC frame allocation failures, or crashes in eth_header()/llc_alloc_frame(); inspect network interface configurations for VLAN usage combined with LLC.

What your security team should do

  • Prioritize kernel updates on any systems exposing LLC over VLAN or stacked Ethernet devices
  • Review network configurations to determine if LLC is required and disable where possible
  • Monitor for kernel oops or skb-related panics on production hosts using these interfaces

The record

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llc_alloc_frame() reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlan_dev_hard_header() pushes a VLAN header before the lower device's Ethernet header. An LLC response on such a device can therefore underflow skb headroom in eth_header(). Use LL_RESERVED_SPACE() to account for the device's actual required headroom while preserving the existing LLC device-type check.

Affected packages

Ecosystem Package Introduced Fixed