CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved:

ppp synctty: ensure a writeable skb header

ppp sync txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp start xmit(), which calls skb cow head().

For example, a PPPoE frame may share its buffer with a clone queued to an AF PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket.

Use skb cow head() to ensure both sufficient headroom and a writable header.