Cloudanix VulnDB

CVE-2026-99033

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how the Linux kernel handles certain network packets on specialized interfaces can make the whole computer crash suddenly.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing dev_has_header() guard in packet_rcv_spkt() allows skb_push with a large negative length derived from the 0xFFFF mac_header sentinel on L3-only devices such as CAN, triggering skb_under_panic and a kernel BUG from softirq context.

Why it matters to the business

An attacker with the ability to inject frames on a compatible interface and a local SOCK_PACKET socket can force an immediate full-system panic and reboot, resulting in denial of service and loss of availability for any workloads on the affected host.

How an attack unfolds

An attacker creates a SOCK_PACKET socket bound to a CAN or similar L3 device, then injects a frame that reaches packet_rcv_spkt(); because the mac_header sentinel is not reset, the length calculation underflows, skb_push panics the kernel, and the system crashes before any further processing occurs.

How to fix it

Apply the upstream fix that wraps the skb_push with the same dev_has_header() check used by packet_rcv() and tpacket_rcv(); rebuild and deploy the patched kernel. Until a fixed kernel is available, avoid binding SOCK_PACKET sockets to L3-only interfaces or disable the relevant device drivers.

How to confirm the fix worked

Confirm the patch is present by inspecting net/packet/af_packet.c for the dev_has_header() predicate around the skb_push in packet_rcv_spkt(); re-test with a slcan or equivalent device and a SOCK_PACKET socket to verify no panic occurs on frame reception.

Typical attack path

  1. Obtain CAP_NET_RAW or equivalent to create a SOCK_PACKET socket
  2. Bind the socket to a device lacking a visible link-layer header (CAN, SLACAN, etc.)
  3. Inject or cause a frame to arrive on that device
  4. packet_rcv_spkt() performs the unguarded skb_push and panics

How to detect it

Search kernel logs and crash dumps for the strings skb_under_panic, skb_panic, packet_rcv_spkt, and the call trace involving __netif_receive_skb_core; correlate with creation of SOCK_PACKET sockets on CAN-family devices.

  • skb_under_panic: text:
  • packet_rcv_spkt+0xe1/0x170
  • Kernel panic - not syncing: Fatal exception in interrupt

What your security team should do

  • Prioritize kernel upgrade on any system exposing CAN, SLACAN, or other L3-only network interfaces
  • Audit for and remove unnecessary SOCK_PACKET socket usage in applications and scripts
  • Monitor for kernel oops/panic reports containing skb_under_panic or packet_rcv_spkt in the stack trace

The record

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That subtraction is only meaningful when the device actually has a link layer header. packet_rcv() and tpacket_rcv() both wrap it in dev_has_header(), which is also the predicate the block comment at the top of the file states the restore in terms of; packet_rcv_spkt() does not. commit d549699048b4 ("net/packet: fix packet receive on L3 devices without visible hard header") introduced the helper and changed the two call sites, and this one stayed behind. A device without a visible ll header can leave skb->mac_header at the 0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does: init_can_skb() sets pkt_type and ip_summed but does not reset the headers, and commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") dropped the skb_reset_*_header() calls that used to be there. skb_mac_header() is then 0xFFFF, the length becomes a large negative number and skb_push() reports it through skb_under_panic() -- from softirq context, so it is a full system panic even with panic_on_oops=0: skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0 kernel BUG at net/core/skbuff.c:214! RIP: 0010:skb_panic+0x50/0x60 Call Trace: <IRQ> skb_push+0x38/0x40 packet_rcv_spkt+0xe1/0x170 __netif_receive_skb_core.constprop.0+0x7e8/0xd30 ... Kernel panic - not syncing: Fatal exception in interrupt The socket type is reachable: packet_create() accepts SOCK_PACKET alongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check, and neither the socket length nor a capability check keeps it away from a CAN interface. The missing skb_reset_*_header() calls in init_can_skb() are a regression in their own right and are being fixed separately, but a packet socket should not turn a link layer that did not initialise its mac header into a kernel panic. Guard the push the way the other two receive paths do. Tested on v7.3-rc5 under QEMU with a slcan device on a pty, which is the driver RX path: vcan does not reproduce it, because can_send() resets the headers on the way out. One SOCK_PACKET socket bound to can0 and one frame written into the line discipline panics an unpatched kernel with the trace above; the same image with this patch prints no panic and powers off normally. Both kernels are this tree, defconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.

Affected packages

Ecosystem Package Introduced Fixed