CVE-2026-98375

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: drop RX packets with a short Ethernet header

handle incoming queue() pulls pull to bytes into the head before calling eth type trans(). pull to is the length of the first RX slot, capped at RX COPY THRESHOLD, and that length comes from the backend. Nothing checks it against ETH HLEN.

If the first slot is shorter than ETH HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth type trans() BUG()s in skb pull(). If the whole packet is shorter than ETH HLEN, eth type trans() reads the header past the end of the data instead.

Pull at least ETH HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.