« Volver al listado

CVE-2026-90078

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

syzbot reported a warning in skb_network_header_len() triggered by tcf_skbmod_act():

There are a few issues in tcf_skbmod_act():

Detalles técnicos trazas, registros y código del informe original
  !skb_transport_header_was_set(skb)
  WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline]
  WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55

1. Calling skb_network_header_len() assumes skb->transport_header is set,
   which is not guaranteed when tcf_skbmod_act() runs at TC ingress.
2. Unconditionally calling skb_mac_header_len() at the beginning of
   tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the
   MAC header is unset, evaluating to an underflowed garbage length.
3. On TC ingress, skb->data points to the network header. Adding the MAC
   header length to the IP header length causes skb_ensure_writable() to
   request more bytes than the actual IP packet length, dropping valid
   short packets (e.g. 28-byte UDP/IPv4 packets).

Fix these by:
- Using skb_network_offset(skb) + sizeof(struct iphdr/ipv6hdr) for
  SKBMOD_F_ECN so that the required length is correctly calculated on
  both ingress (offset == 0) and egress (offset == mac_len).
- Setting max_edit_len to ETH_HLEN for Ethernet header modifications
  after validating ARPHRD_ETHER.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90078",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "985a37781ade19061400100c2ba0f43979dd4d63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "d896843d8d925f0adbba319020595cfb1a7bcd57",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "0675cff3c2924eb9b80d9dd250cf56a1140af157",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "e8a2027b7e686784a69b2dfcee841d779919f313",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "1719865b20b22c88d2a55e922eff5ca31b0841f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "62126464f3a6159c0a3dd89e196ba65bfeb0afc6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
              "lessThan": "81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/sched/act_skbmod.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/sched/act_skbmod.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:16:57.057",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0675cff3c2924eb9b80d9dd250cf56a1140af157",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1719865b20b22c88d2a55e922eff5ca31b0841f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/62126464f3a6159c0a3dd89e196ba65bfeb0afc6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/985a37781ade19061400100c2ba0f43979dd4d63",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d896843d8d925f0adbba319020595cfb1a7bcd57",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e8a2027b7e686784a69b2dfcee841d779919f313",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbmod: fix length calculations and avoid invalid header warnings\n\nsyzbot reported a warning in skb_network_header_len() triggered\nby tcf_skbmod_act():\n\n  !skb_transport_header_was_set(skb)\n  WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline]\n  WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55\n\nThere are a few issues in tcf_skbmod_act():\n\n1. Calling skb_network_header_len() assumes skb->transport_header is set,\n   which is not guaranteed when tcf_skbmod_act() runs at TC ingress.\n2. Unconditionally calling skb_mac_header_len() at the beginning of\n   tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the\n   MAC header is unset, evaluating to an underflowed garbage length.\n3. On TC ingress, skb->data points to the network header. Adding the MAC\n   header length to the IP header length causes skb_ensure_writable() to\n   request more bytes than the actual IP packet length, dropping valid\n   short packets (e.g. 28-byte UDP/IPv4 packets).\n\nFix these by:\n- Using skb_network_offset(skb) + sizeof(struct iphdr/ipv6hdr) for\n  SKBMOD_F_ECN so that the required length is correctly calculated on\n  both ingress (offset == 0) and egress (offset == mac_len).\n- Setting max_edit_len to ETH_HLEN for Ethernet header modifications\n  after validating ARPHRD_ETHER."
    }
  ],
  "lastModified": "2026-09-17T17:16:57.057",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}