---
id: "CVE-2026-99066"
kind: "vulnerability"
aliases: ["CVE-2026-99066"]
title: "Linux kernel: CAN RX skbs can panic the machine via SOCK_PACKET"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["can-bus", "embedded", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["no-can-interfaces", "no-sock-packet-listeners"]
published_at: "2026-10-23T13:17:30+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T04:53:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99066", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Linux kernel: CAN RX skbs can panic the machine via SOCK_PACKET

Linux CAN RX socket buffers are created without their MAC and network header offsets, so a SOCK_PACKET receiver can overflow a length calculation and hit a kernel BUG. The result is a full machine panic, which an attacker can trigger by sending CAN traffic to a host that has a SOCK_PACKET listener.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Move the Linux kernel to a release that includes the fix for CVE-2026-99066 (version unknown from the sources)
- unknown

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99066

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

can: dev: init_can_skb(): restore skb header initialization

Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
removed the skb_reset_mac_header()/skb_reset_network_header()/
skb_reset_transport_header() calls from init_can_skb(). As a result, RX
skbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.
When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length
calculation overflows and triggers skb_under_panic -> kernel BUG -> full
machine panic.

The same issue was originally reported in 2014 on linux-can and fixed by
commit 969439016d2c ("can: add missing initialisations in CAN related
skbuffs"). packet_rcv_spkt() itself has never been hardened: only
packet_rcv() and tpacket_rcv() gained dev_has_header() checks in
commit d549699048b4 ("net/packet: fix packet receive on L3 devices
without visible hard header").

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_