CVE-2026-98526
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.22 %mayor que el 12 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
llc: reservar headroom del dispositivo para los frames asignados
llc_alloc_frame() reserva el headroom de la capa de enlace en función del tipo de dispositivo. Esto es insuficiente para dispositivos Ethernet apilados, como los dispositivos VLAN, donde vlan_dev_hard_header() añade una cabecera VLAN antes de la cabecera Ethernet del dispositivo inferior. Una respuesta LLC en un dispositivo de este tipo puede, por tanto, provocar un desbordamiento por defecto del headroom del skb en eth_header().
Utilizar LL_RESERVED_SPACE() para tener en cuenta el headroom real requerido por el dispositivo, manteniendo la comprobación existente del tipo de dispositivo LLC.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.22 %
- Percentil entre todas las CVEs puntuadas
- 12
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/018020f5a48cc86fdd6dc2d380f6c70443ae7639
- https://git.kernel.org/stable/c/16ceac2daa89dd16917bc488ab05b9dd6961a603
- https://git.kernel.org/stable/c/1937222c2511ac91377d39f28106c34734f5f8c6
- https://git.kernel.org/stable/c/3361c93e417384ebf28003e0fb6d5304653d3b05
- https://git.kernel.org/stable/c/3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1
- https://git.kernel.org/stable/c/72b5b9a28b996e09b8b5b944370c79851bb68f52
- https://git.kernel.org/stable/c/7c38524b2b2456bd33cb360420da6cbf9cad1b33
- https://git.kernel.org/stable/c/e06f8b6e27cc616d3c587e9784c4a033eb310a16
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98526",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "018020f5a48cc86fdd6dc2d380f6c70443ae7639",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "7c38524b2b2456bd33cb360420da6cbf9cad1b33",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "1937222c2511ac91377d39f28106c34734f5f8c6",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "16ceac2daa89dd16917bc488ab05b9dd6961a603",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "e06f8b6e27cc616d3c587e9784c4a033eb310a16",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "3361c93e417384ebf28003e0fb6d5304653d3b05",
"versionType": "git"
},
{
"status": "affected",
"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a",
"lessThan": "72b5b9a28b996e09b8b5b944370c79851bb68f52",
"versionType": "git"
}
],
"programFiles": [
"net/llc/llc_sap.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.34",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/llc/llc_sap.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:04.063",
"references": [
{
"url": "https://git.kernel.org/stable/c/018020f5a48cc86fdd6dc2d380f6c70443ae7639",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/16ceac2daa89dd16917bc488ab05b9dd6961a603",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1937222c2511ac91377d39f28106c34734f5f8c6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3361c93e417384ebf28003e0fb6d5304653d3b05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/72b5b9a28b996e09b8b5b944370c79851bb68f52",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c38524b2b2456bd33cb360420da6cbf9cad1b33",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e06f8b6e27cc616d3c587e9784c4a033eb310a16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice's Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device's actual required\nheadroom while preserving the existing LLC device-type check."
}
],
"lastModified": "2026-10-19T10:19:07.830",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}