Bug 2554927 (CVE-2026-98526) - CVE-2026-98526 kernel: llc: reserve device headroom for allocated frames
Summary: CVE-2026-98526 kernel: llc: reserve device headroom for allocated frames
Keywords:
Status: NEW
Alias: CVE-2026-98526
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-18 15:33 UTC by OSIDB Bzimport
Modified: 2026-10-19 16:41 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-18 15:33:13 UTC
In the Linux kernel, the following vulnerability has been resolved:

llc: reserve device headroom for allocated frames

llc_alloc_frame() reserves link-layer headroom using the device type.
This is insufficient for stacked Ethernet devices such as VLAN devices,
where vlan_dev_hard_header() pushes a VLAN header before the lower
device's Ethernet header. An LLC response on such a device can
therefore underflow skb headroom in eth_header().

Use LL_RESERVED_SPACE() to account for the device's actual required
headroom while preserving the existing LLC device-type check.


Note You need to log in before you can comment on or make changes to this bug.