Executive brief
The Linux kernel's rmnet network driver contains a null pointer dereference vulnerability in its map command frame processing. An unprivileged user can trigger a kernel panic by crafting a malicious network packet, causing the system to become unresponsive and requiring a restart.
Technical details
The vulnerability exists in the Qualcomm rmnet driver's frame deaggregation logic. When rmnet_map_deaggregate() creates sub-frames from an aggregated packet, it fails to properly initialize the skb->dev pointer. Subsequently, rmnet_map_command() attempts to lock a null device pointer via netif_tx_lock(), triggering a null pointer dereference. An unprivileged attacker can reach this code path by unsharing a network namespace, creating an rmnet interface over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS enabled, then sending a malicious aggregated frame containing a flow-control command. The fix restores the skb->dev assignment that was previously removed, ensuring valid device pointers throughout the deaggregation pipeline.
Affected products
- Linux Linux kernel versions prior to the CVE-2026-89780 fix
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix included in this advisory