Executive brief
The Linux kernel's traffic control (TC) scheduler module contains bugs in how it calculates packet buffer lengths and validates header fields when modifying network packets. These calculation errors can cause the system to drop valid network packets (such as small UDP packets) or trigger kernel warnings, potentially leading to network disruptions or denial of service on systems using TC-based packet scheduling.
Technical details
The vulnerability exists in the tcf_skbmod_act() function in net/sched/act_skbmod.c. The function incorrectly assumes that packet transport headers are always set (not true at TC ingress), unconditionally calls skb_mac_header_len() which can underflow on L3 devices like TUN interfaces, and miscalculates the required writable buffer length by adding MAC header length to IP header length—causing skb_ensure_writable() to request more bytes than actual packet size. This results in valid short packets (e.g., 28-byte UDP/IPv4) being dropped. The fix corrects length calculations to use skb_network_offset() + sizeof(struct iphdr/ipv6hdr) for ECN modifications and limits MAC header validation to Ethernet devices with proper bounds checking.
Affected products
- Linux Linux Kernel Multiple versions before 2026-09-14
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched