CVE-2026-98554

In the Linux kernel, the following vulnerability has been resolved:

vlan: ensure sufficient headroom in vlan dev hard header()

Callers that only reserve ETH HLEN or less (such as llc alloc frame()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLAN FLAG REORDER HDR or bonding/team switching slaves), can reach vlan dev hard header() with insufficient headroom and trigger skb under panic().

Use skb cow head() in vlan dev hard header() when VLAN FLAG REORDER HDR is not set to ensure sufficient headroom for the VLAN header(s) and the underlying device hard header.

Use READ ONCE() to read dev->hard header len and dev->needed headroom as they can be updated concurrently under RTNL (e.g. in vlan transfer features()) while vlan dev hard header() runs locklessly on the transmit path. Also avoid LL RESERVED SPACE(dev) here so that the extra HH DATA MOD alignment padding does not trigger unnecessary pskb expand head() reallocations on inner stacked VLAN devices after the outer VLAN header has been pushed.