CVE-2026-98526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98526", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.355Z", "datePublished": "2026-10-18T15:17:44.018Z", "dateUpdated": "2026-10-19T09:21:07.983Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:07.983Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice's Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device's actual required\nheadroom while preserving the existing LLC device-type check."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/llc/llc_sap.c"], "versions": [{"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "018020f5a48cc86fdd6dc2d380f6c70443ae7639", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "7c38524b2b2456bd33cb360420da6cbf9cad1b33", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "1937222c2511ac91377d39f28106c34734f5f8c6", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "16ceac2daa89dd16917bc488ab05b9dd6961a603", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "e06f8b6e27cc616d3c587e9784c4a033eb310a16", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "3361c93e417384ebf28003e0fb6d5304653d3b05", "status": "affected", "versionType": "git"}, {"version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "lessThan": "72b5b9a28b996e09b8b5b944370c79851bb68f52", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/llc/llc_sap.c"], "versions": [{"version": "2.6.34", "status": "affected"}, {"version": "0", "lessThan": "2.6.34", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/018020f5a48cc86fdd6dc2d380f6c70443ae7639"}, {"url": "https://git.kernel.org/stable/c/3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1"}, {"url": "https://git.kernel.org/stable/c/7c38524b2b2456bd33cb360420da6cbf9cad1b33"}, {"url": "https://git.kernel.org/stable/c/1937222c2511ac91377d39f28106c34734f5f8c6"}, {"url": "https://git.kernel.org/stable/c/16ceac2daa89dd16917bc488ab05b9dd6961a603"}, {"url": "https://git.kernel.org/stable/c/e06f8b6e27cc616d3c587e9784c4a033eb310a16"}, {"url": "https://git.kernel.org/stable/c/3361c93e417384ebf28003e0fb6d5304653d3b05"}, {"url": "https://git.kernel.org/stable/c/72b5b9a28b996e09b8b5b944370c79851bb68f52"}], "title": "llc: reserve device headroom for allocated frames", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/llc/llc_sap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "018020f5a48cc86fdd6dc2d380f6c70443ae7639", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "7c38524b2b2456bd33cb360420da6cbf9cad1b33", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "1937222c2511ac91377d39f28106c34734f5f8c6", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "16ceac2daa89dd16917bc488ab05b9dd6961a603", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "e06f8b6e27cc616d3c587e9784c4a033eb310a16", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "3361c93e417384ebf28003e0fb6d5304653d3b05", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}, {"lessThan": "72b5b9a28b996e09b8b5b944370c79851bb68f52", "status": "affected", "version": "bf9ae5386bca8836c16e69ab8fdbe46767d7452a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/llc/llc_sap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.34"}, {"lessThan": "2.6.34", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice's Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device's actual required\nheadroom while preserving the existing LLC device-type check."}], "id": "CVE-2026-98526", "lastModified": "2026-10-19T10:19:07.830", "metrics": {}, "published": "2026-10-18T16:17:04.063", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/018020f5a48cc86fdd6dc2d380f6c70443ae7639"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/16ceac2daa89dd16917bc488ab05b9dd6961a603"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1937222c2511ac91377d39f28106c34734f5f8c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3361c93e417384ebf28003e0fb6d5304653d3b05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72b5b9a28b996e09b8b5b944370c79851bb68f52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c38524b2b2456bd33cb360420da6cbf9cad1b33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e06f8b6e27cc616d3c587e9784c4a033eb310a16"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: llc: reserve device headroom for allocated frames", "id": "2554927", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554927"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-124", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nllc: reserve device headroom for allocated frames\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice's Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\nUse LL_RESERVED_SPACE() to account for the device's actual required\nheadroom while preserving the existing LLC device-type check.", "A flaw was found in the Linux kernel's Logical Link Control (LLC) subsystem. This flaw allows an adjacent attacker to cause a Denial of Service (DoS) via a kernel crash. When transmitting an LLC response over stacked network interfaces, such as Virtual Local Area Networks (VLANs), the kernel allocates network buffers without sufficient headroom for layered headers. This failure causes a buffer underflow during packet construction, terminating system operations."], "name": "CVE-2026-98526", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98526\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98526\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98526.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,018020f5a48cc86fdd6dc2d380f6c70443ae7639)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,7c38524b2b2456bd33cb360420da6cbf9cad1b33)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,1937222c2511ac91377d39f28106c34734f5f8c6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,16ceac2daa89dd16917bc488ab05b9dd6961a603)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,e06f8b6e27cc616d3c587e9784c4a033eb310a16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,3361c93e417384ebf28003e0fb6d5304653d3b05)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bf9ae5386bca8836c16e69ab8fdbe46767d7452a,72b5b9a28b996e09b8b5b944370c79851bb68f52)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.34"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.34)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:30:14.147635+00:00", "updated": "2026-10-20T16:30:06.798446+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}