PT-2026-106616 · Linux · Linux
CVE-2026-98287
·
Publicado
2026-10-06
·
Atualizado
2026-10-06
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
pppoatm: ensure a writable skb header and linear data
In pppoatm send(), LLC encapsulation checks whether there is sufficient
headroom for the 4-byte LLC header, but does not ensure that the skb header
is writable.
Normal transmit packets passing through ppp start xmit() have their header
unshared via skb cow head(). However, packets can also reach pppoatm send()
via PPP channel bridging (PPPIOCBRIDGECHAN) without going through
ppp start xmit().
Use skb cow head() to ensure both sufficient headroom and a writable
header before pushing the LLC header.
While at it:
- Call pskb may pull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging).
- Defer SC COMP PROT protocol compression until after pppoatm may send() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skb push().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux