PT-2026-106616 · Linux · Linux
CVE-2026-98287
·
Published
2026-10-06
·
Updated
2026-10-06
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
pppoatm: ensure a writable skb header and linear data
In pppoatm send(), LLC encapsulation checks whether there is sufficient
headroom for the 4-byte LLC header, but does not ensure that the skb header
is writable.
Normal transmit packets passing through ppp start xmit() have their header
unshared via skb cow head(). However, packets can also reach pppoatm send()
via PPP channel bridging (PPPIOCBRIDGECHAN) without going through
ppp start xmit().
Use skb cow head() to ensure both sufficient headroom and a writable
header before pushing the LLC header.
While at it:
- Call pskb may pull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging).
- Defer SC COMP PROT protocol compression until after pppoatm may send() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skb push().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux