CVE-2026-98158

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ppp async component where the process input packet() function incorrectly resets a reused socket buffer (skb) headroom to zero during a frame-error path. This violates the NET SKB PAD guarantee, which ensures that buffers allocated via dev alloc skb() have sufficient headroom for the receive path.

When a peer sends a bad-FCS frame followed by a specific sequence, it can lead to a situation where ppp receive nonmp frame() attempts to push a two-byte direction tag using skb push(), resulting in a memory access below the buffer head and triggering a kernel panic. Additionally, if CCP compression is enabled, ppp decompress frame() may cause an out-of-bounds read before the buffer head. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending two specially crafted crashing frames.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.