Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically in how it handles certain types of network traffic tags (VLANs). An attacker could exploit this flaw to cause a system crash or instability by sending specially crafted network packets that trigger an out-of-bounds memory read. This primarily impacts the availability of the affected system, potentially leading to a denial-of-service condition.
Technical details
The vulnerability exists in the tcf_csum_act() function within net/sched/act_csum.c. The code walks nested VLAN headers directly from skb->data without verifying if the full header is present in the linear area of the socket buffer. By providing a packet where only a partial inner VLAN header is linearized, an attacker can trigger an out-of-bounds read when the kernel accesses h_vlan_encapsulated_proto. This can lead to a violation of skb invariants and a subsequent kernel panic or denial-of-service. The fix introduces a pskb_may_pull() check to ensure the full VLAN_HLEN is available before access.
Affected products
- Linux Linux Kernel 4.19.99 to 4.20, 5.1 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-25: disclosed
- 2026-04-25: advisory
- 2026-06-01: patched
References
- https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725
- https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5
- https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09
- https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513
- https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b
- https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834
- https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2