{"id":"CVE-2026-98554","kind":"vulnerability","aliases":["CVE-2026-98554"],"related":[],"title":"Linux kernel: VLAN transmit path can crash on short headroom","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),\nor skbs allocated before dynamic device/headroom changes (e.g. toggling\nVLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach\nvlan_dev_hard_header() with insufficient headroom and trigger\nskb_under_panic().\n\nUse skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR\nis not set to ensure sufficient headroom for the VLAN header(s) and the\nunderlying device hard header.\n\nUse READ_ONCE() to read dev->hard_header_len and dev->needed_headroom as\nthey can be updated concurrently under RTNL (e.g. in\nvlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on\nthe transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the\nextra HH_DATA_MOD alignment padding does not trigger unnecessary\npskb_expand_head() reallocations on inner stacked VLAN devices after the\nouter VLAN header has been pushed.","summary":"The Linux kernel's VLAN header builder can run with too little headroom in a packet buffer, which triggers a skb_under_panic kernel crash. The sources do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","self-hosted","vlan"],"not_affected_if":["no-vlan-devices"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds in the distribution's advisory (unknown from the sources)\n- `ip -d link show` to see whether VLAN devices are in use (reorder_hdr flag)","fix":"- Update the Linux kernel to a build that includes the upstream commit 'vlan: ensure sufficient headroom in vlan_dev_hard_header()' (fixed version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:29+00:00","updated_at":"2026-10-25T05:23:29+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a build that includes the upstream commit 'vlan: ensure sufficient headroom in vlan_dev_hard_header()' (fixed version unknown from the sources)","reach":"local","title":"Linux kernel: VLAN transmit path can crash on short headroom","impact":"medium","summary":"The Linux kernel's VLAN header builder can run with too little headroom in a packet buffer, which triggers a skb_under_panic kernel crash. The sources do not describe code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","vlan","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crashes via skb_under_panic on the transmit path","analyst_note":"Check the kernel stable backports and distribution advisories for the fixed version numbers and whether a remote trigger exists.","how_to_check":"- `uname -r` and compare against the fixed kernel builds in the distribution's advisory (unknown from the sources)\n- `ip -d link show` to see whether VLAN devices are in use (reorder_hdr flag)","needs_analyst":true,"not_affected_if":["no-vlan-devices"],"who_is_affected":"Systems running the Linux kernel with VLAN devices, especially those that toggle VLAN_FLAG_REORDER_HDR or switch bonding/team slaves, or use llc frames over VLANs. Hosts without VLAN interfaces are unlikely to reach the vulnerable path, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3657,"output_tokens":583,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98554':13A,16A 'align':205C 'alloc':89C,93C 'also':191C 'avoid':192C 'bonding/team':105C 'buffer':40B 'builder':30B 'caller':78C 'chang':97C 'code':54B 'concurr':172C 'cow':124C 'crash':7A,48B 'cve':11A,14A 'data':57B,203C 'describ':53B 'dev':75C,111C,128C,159C,164C,182C,196C 'devic':151C,219C 'device/headroom':96C 'dynam':95C 'e.g':98C,175C 'ensur':70C,140C 'eth':82C 'execut':55B 'expand':212C 'exposur':58B 'extra':201C 'featur':179C 'flag':101C,133C 'follow':64C 'frame':90C 'hard':76C,112C,129C,152C,160C,183C 'hdr':103C,135C 'head':125C,213C 'header':29B,77C,113C,130C,146C,153C,161C,184C,224C 'headroom':10A,36B,72C,116C,142C,166C 'hh':202C 'hlen':83C 'host':22B 'inner':216C 'insuffici':115C 'kernel':2A,17B,26B,47B,62C 'len':162C 'less':85C 'linux':1A,18B,25B,61C 'littl':35B 'll':193C 'llc':88C 'lockless':186C 'mod':204C 'need':165C 'outer':222C 'packet':39B 'pad':206C 'panic':46B,121C 'path':5A,190C 'pskb':211C 'push':227C 'reach':109C 'read':155C,158C 'realloc':214C 'reorder':102C,134C 'reserv':81C,194C 'resolv':68C 'rtnl':174C 'run':32B,185C 'runtim':19B 'self':21B 'self-host':20B 'set':138C 'short':9A 'skb':44B,119C,123C 'skbs':92C 'slave':107C 'sourc':50B 'space':195C 'stack':217C 'suffici':71C,141C 'switch':106C 'toggl':99C 'transfer':178C 'transmit':4A,189C 'trigger':42B,118C,209C 'under':150C 'unnecessari':210C 'updat':171C 'use':122C,154C 'vlan':3A,23B,28B,69C,74C,100C,110C,127C,132C,145C,177C,181C,218C,223C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with VLAN devices, especially those that toggle VLAN_FLAG_REORDER_HDR or switch bonding/team slaves, or use llc frames over VLANs. Hosts without VLAN interfaces are unlikely to reach the vulnerable path, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98554","severity":null,"published_at":"2026-10-18T16:17:07+00:00","modified_at":"2026-10-19T10:19:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}