CVE-2026-89780

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null-pointer dereference occurs in the Qualcomm rmnet driver. The function rmnet map deaggregate() allocates sub-frames using alloc skb() but leaves the skb->dev variable as NULL. While rmnet map ingress handler() assigns a device on the data path, MAP command frames are dispatched to rmnet map command() first. Consequently, rmnet map send ack() attempts to execute netif tx lock() on the NULL skb->dev device, leading to a kernel panic. An unprivileged user can trigger this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS DEAGGREGATION and INGRESS MAP COMMANDS enabled, and writing an aggregated frame containing a flow-control command to the tap file descriptor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.