Live › vulnerability › CVE-2026-98554
Go to dashboardThe Linux kernel's VLAN header builder can run with too little headroom in a packet buffer, which triggers a skb_under_panic kernel crash. The sources do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with VLAN devices, especially those that toggle VLAN_FLAG_REORDER_HDR or switch bonding/team slaves, or use llc frames over VLANs. Hosts without VLAN interfaces are unlikely to reach the vulnerable path, though the sources do not state this explicitly.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds in the distribution's advisory (unknown from the sources)ip -d link show to see whether VLAN devices are in use (reorder_hdr flag)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
vlan: ensure sufficient headroom in vlan_dev_hard_header()
Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach vlan_dev_hard_header() with insufficient headroom and trigger skb_under_panic().
Use skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR is not set to ensure sufficient headroom for the VLAN header(s) and the underlying device hard header.
Use READ_ONCE() to read dev->hard_header_len and dev->needed_headroom as they can be updated concurrently under RTNL (e.g. in vlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on the transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the extra HH_DATA_MOD alignment padding does not trigger unnecessary pskb_expand_head() reallocations on inner stacked VLAN devices after the outer VLAN header has been pushed.
This page as .md · .json · in your agent: get_signal("CVE-2026-98554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.