{"id":"CVE-2026-99033","kind":"vulnerability","aliases":["CVE-2026-99033"],"related":[],"title":"Linux kernel: packet sockets on CAN devices can panic the system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: guard the ll header push in packet_rcv_spkt()\n\npacket_rcv_spkt() restores the link layer header with\n\n\tskb_push(skb, skb->data - skb_mac_header(skb));\n\nThat subtraction is only meaningful when the device actually has a link\nlayer header.  packet_rcv() and tpacket_rcv() both wrap it in\ndev_has_header(), which is also the predicate the block comment at the\ntop of the file states the restore in terms of; packet_rcv_spkt() does\nnot.  commit d549699048b4 (\"net/packet: fix packet receive on L3\ndevices without visible hard header\") introduced the helper and changed\nthe two call sites, and this one stayed behind.\n\nA device without a visible ll header can leave skb->mac_header at the\n0xFFFF sentinel that __alloc_skb() initialises it to.  A CAN skb does:\ninit_can_skb() sets pkt_type and ip_summed but does not reset the\nheaders, and commit 9f10374bb024 (\"can: remove private CAN skb\nheadroom infrastructure\") dropped the skb_reset_*_header() calls that\nused to be there.  skb_mac_header() is then 0xFFFF, the length becomes\na large negative number and skb_push() reports it through\nskb_under_panic() -- from softirq context, so it is a full system panic\neven with panic_on_oops=0:\n\n  skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0\n  kernel BUG at net/core/skbuff.c:214!\n  RIP: 0010:skb_panic+0x50/0x60\n  Call Trace:\n   <IRQ>\n   skb_push+0x38/0x40\n   packet_rcv_spkt+0xe1/0x170\n   __netif_receive_skb_core.constprop.0+0x7e8/0xd30\n   ...\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe socket type is reachable: packet_create() accepts SOCK_PACKET\nalongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check,\nand neither the socket length nor a capability check keeps it away\nfrom a CAN interface.\n\nThe missing skb_reset_*_header() calls in init_can_skb() are a\nregression in their own right and are being fixed separately, but a\npacket socket should not turn a link layer that did not initialise its\nmac header into a kernel panic.  Guard the push the way the other two\nreceive paths do.\n\nTested on v7.3-rc5 under QEMU with a slcan device on a pty, which is\nthe driver RX path: vcan does not reproduce it, because can_send()\nresets the headers on the way out.  One SOCK_PACKET socket bound to\ncan0 and one frame written into the line discipline panics an\nunpatched kernel with the trace above; the same image with this patch\nprints no panic and powers off normally.  Both kernels are this tree,\ndefconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.","summary":"A packet socket (SOCK_PACKET) bound to a CAN interface triggers an unguarded skb_push in packet_rcv_spkt, causing a kernel BUG and full system panic on received frames. The sources describe a denial of service; no code execution is stated.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["can-bus","embedded","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["default-config","no-can-interfaces"],"how_to_check":"- Run `uname -r` and compare against the kernel version that contains the fix (unknown from sources)\n- Check whether CAN interfaces such as `can0` are present with `ip -details link show type can`\n- Check whether any process opens SOCK_PACKET sockets, which needs CAP_NET_RAW","fix":"- Update the Linux kernel to a release that includes the net/packet fix for packet_rcv_spkt (fixed version: unknown from sources)\n- Until patched, restrict CAP_NET_RAW to trusted users or unload CAN drivers if unused","status":"open","published_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:22+00:00","updated_at":"2026-10-25T04:54:22+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T04:54:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the net/packet fix for packet_rcv_spkt (fixed version: unknown from sources)\n- Until patched, restrict CAP_NET_RAW to trusted users or unload CAN drivers if unused","reach":"local","title":"Linux kernel: packet sockets on CAN devices can panic the system","impact":"medium","summary":"A packet socket (SOCK_PACKET) bound to a CAN interface triggers an unguarded skb_push in packet_rcv_spkt, causing a kernel BUG and full system panic on received frames. The sources describe a denial of service; no code execution is stated.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","can-bus","embedded","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Kernel panic takes the whole system down from a received frame","analyst_note":"Find the fixed kernel version and stable backport commit for the net/packet guard; sources provided no version or severity.","how_to_check":"- Run `uname -r` and compare against the kernel version that contains the fix (unknown from sources)\n- Check whether CAN interfaces such as `can0` are present with `ip -details link show type can`\n- Check whether any process opens SOCK_PACKET sockets, which needs CAP_NET_RAW","needs_analyst":true,"not_affected_if":["no-can-interfaces","default-config"],"who_is_affected":"Systems that run a Linux kernel with CAN devices (for example slcan or other CAN drivers) and allow users with CAP_NET_RAW to open SOCK_PACKET sockets. Hosts without CAN interfaces are not exposed by the described path, and vcan does not reproduce it according to the reporter.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4274,"output_tokens":649,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':314C,320C,325C,329C '-2026':13A,16A '-65455':294C '-65471':296C '-99033':14A,17A '0':286C,328C '0010':311C '0x180':302C '0x50':300C '0xffff':201C,254C '214':309C '9f10374bb024':230C 'accept':346C 'actual':117C 'alloc':204C 'alongsid':349C 'also':137C 'away':373C 'becom':257C 'behind':186C,355C 'block':141C 'bound':34B,469C 'bug':51B,306C 'bus':20B 'call':180C,243C,316C,383C 'can-bus':18B 'can0':304C,471C 'cap':358C 'capabl':369C 'caus':48B 'chang':177C 'check':361C,370C 'code':67B 'comment':142C 'commit':160C,229C 'config':508C 'context':273C 'creat':345C 'cve':12A,15A 'd549699048b4':161C 'data':104C,298C 'defconfig':506C 'denial':63B 'describ':61B 'dev':132C,303C 'devic':7A,116C,168C,188C,440C 'dgram':354C 'differ':512C 'disciplin':479C 'driver':447C 'drop':238C 'embed':21B 'end':301C 'even':281C 'except':336C 'execut':68B 'fatal':335C 'ffffffff8bd21bc1':292C 'file':148C 'fix':163C,398C 'follow':76C 'frame':58B,474C 'full':53B,278C 'guard':82C,421C 'hard':171C 'head':297C 'header':85C,98C,107C,122C,134C,172C,193C,198C,227C,242C,251C,382C,416C,460C 'headroom':236C 'helper':175C 'host':28B 'hunk':516C 'imag':490C 'infrastructur':22B,237C 'init':213C,385C 'initialis':206C,413C 'interfac':38B,377C 'interrupt':338C 'introduc':173C 'ip':220C 'keep':371C 'kernel':2A,25B,50B,74C,305C,331C,419C,483C,502C 'l3':167C 'larg':259C 'layer':97C,121C,409C 'leav':195C 'len':293C 'length':256C,366C 'line':478C 'link':96C,120C,408C 'linux':1A,24B,73C 'linux-kernel':23B 'll':84C,192C 'mac':106C,197C,250C,415C 'meaning':113C 'miss':379C 'negat':260C 'neither':363C 'net':359C 'net/core/skbuff.c':308C 'net/packet':81C,162C 'netif_receive_skb_core.constprop':327C 'normal':500C 'number':261C 'one':184C,465C,473C 'oop':285C 'packet':3A,30B,33B,45B,88C,91C,123C,155C,164C,322C,344C,348C,402C,467C 'panic':9A,55B,270C,280C,283C,290C,313C,332C,420C,480C,496C 'patch':493C 'path':430C,449C 'pkt':217C 'plus':507C 'power':498C 'predic':139C 'print':494C 'privat':233C 'pti':443C 'push':43B,86C,101C,264C,319C,423C 'put':295C 'qemu':436C 'raw':351C,360C 'rcv':46B,89C,92C,124C,127C,156C,323C 'reachabl':343C 'receiv':57B,165C,429C 'regress':390C 'remov':232C 'report':265C 'reproduc':453C 'reset':225C,241C,381C,458C 'resolv':80C 'restor':94C,151C 'right':394C 'rip':310C 'rx':448C 'self':27B 'self-host':26B 'send':457C 'sentinel':202C 'separ':399C 'servic':65B 'set':216C 'site':181C 'skb':42B,100C,102C,103C,105C,108C,196C,205C,211C,215C,235C,240C,249C,263C,268C,288C,312C,318C,380C,387C 'skbuff':287C 'slcan':439C,510C 'sock':32B,347C,350C,353C,466C 'socket':4A,31B,340C,365C,403C,468C 'softirq':272C 'sourc':60B 'spkt':47B,90C,93C,157C,324C 'state':70B,149C 'stay':185C 'subtract':110C 'sum':221C 'sync':334C 'system':11A,54B,279C 'tail':299C 'term':153C 'test':432C 'text':291C 'top':145C 'tpacket':126C 'trace':317C,486C 'tree':505C 'trigger':39B 'turn':406C 'two':179C,428C 'type':218C,341C 'unguard':41B 'unpatch':482C 'use':245C 'v7.3-rc5':434C 'vcan':450C 'visibl':170C,191C 'vulner':77C 'way':425C,463C 'without':169C,189C 'wrap':129C 'written':475C 'x38/0x40':321C 'x50/0x60':315C 'x7e8/0xd30':330C 'xe1/0x170':326C 'y':511C","nicknames":[],"mitigations":[],"who_affected":"Systems that run a Linux kernel with CAN devices (for example slcan or other CAN drivers) and allow users with CAP_NET_RAW to open SOCK_PACKET sockets. Hosts without CAN interfaces are not exposed by the described path, and vcan does not reproduce it according to the reporter.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99033","severity":null,"published_at":"2026-10-23T13:17:26+00:00","modified_at":"2026-10-23T13:17:26+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}