{"id":"CVE-2026-98526","kind":"vulnerability","aliases":["CVE-2026-98526"],"related":[],"title":"Linux kernel: LLC frames on VLAN devices can underflow packet headroom","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice's Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device's actual required\nheadroom while preserving the existing LLC device-type check.","summary":"The Linux kernel's LLC frame allocator reserves too little link-layer headroom for stacked Ethernet devices such as VLAN interfaces. An LLC response sent on such a device can underflow the socket buffer headroom in eth_header().","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","llc","runtime","vlan"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:07+00:00","updated_at":"2026-10-25T05:25:07+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-10-25T05:25:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: LLC frames on VLAN devices can underflow packet headroom","impact":"low","summary":"The Linux kernel's LLC frame allocator reserves too little link-layer headroom for stacked Ethernet devices such as VLAN interfaces. An LLC response sent on such a device can underflow the socket buffer headroom in eth_header().","category":"runtime","nicknames":[],"who_cares":["linux","kernel","vlan","llc"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"The sources give only the kernel commit text from NVD; check the upstream stable fix commit and kernel advisory for the fixed versions, impact and whether a remote trigger exists.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000519,"input_tokens":3411,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98526':14A,17A 'account':138C 'actual':143C 'alloc':29B,77C,80C 'buffer':57B 'check':154C 'cve':12A,15A 'dev':104C 'devic':7A,40B,52B,74C,89C,97C,101C,114C,124C,141C,152C 'device-typ':151C 'eth':60B,131C 'ethernet':39B,96C,116C 'exist':149C 'follow':67C 'frame':4A,28B,78C,81C 'hard':105C 'header':61B,106C,110C,117C,132C 'headroom':11A,36B,58B,75C,86C,129C,145C 'insuffici':93C 'interfac':44B 'kernel':2A,18B,25B,65C 'layer':35B,85C 'link':34B,84C 'link-lay':33B,83C 'linux':1A,19B,24B,64C 'littl':32B 'll':134C 'llc':3A,20B,27B,46B,72C,79C,119C,150C 'lower':113C 'packet':10A 'preserv':147C 'push':107C 'requir':144C 'reserv':30B,73C,82C,135C 'resolv':71C 'respons':47B,120C 'runtim':21B 'sent':48B 'skb':128C 'socket':56B 'space':136C 'stack':38B,95C 'therefor':126C 'type':90C,153C 'underflow':9A,54B,127C 'use':87C,133C 'vlan':6A,22B,43B,100C,103C,109C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98526","severity":null,"published_at":"2026-10-18T16:17:04+00:00","modified_at":"2026-10-19T10:19:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}