CVE-2026-97964 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ppp_synctty: ensure a writeable skb header
ppp_sync_txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which calls skb_cow_head().
For example, a PPPoE frame may share its buffer with a clone queued to an AF_PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket.
Use skb_cow_head() to ensure both sufficient headroom and a writable header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel within the ppp_synctty subsystem represents a critical memory safety flaw rooted in improper handling of network buffer descriptors during packet bridging operations. Specifically, the function ppp_sync_txmunge() is responsible for preparing packets for transmission over synchronous tty channels by prepending address and control bytes to the data payload. While this routine correctly verifies that sufficient headroom exists within the socket buffer structure to accommodate these new headers, it fails to verify whether the memory region designated as writable before attempting to modify it. This oversight creates a scenario where kernel code may write into read-only or shared memory segments, leading to potential data corruption and security breaches. The root cause lies in the assumption that all packets reaching this function have undergone standard transmission path sanitization, which is not always true when PPP channel bridging mechanisms are involved.
In normal operation, network frames destined for synchronous tty interfaces typically traverse the ppp_start_xmit() routine, which invokes skb_cow_head to ensure copy-on-write semantics and guarantee that the socket buffer header is exclusively owned by the current context before modification. However, this safeguard is bypassed when packets arrive via PPP channel bridging paths where they do not pass through the standard transmission entry point. A concrete example of this failure mode involves a Point-to-Point Protocol over Ethernet frame sharing its underlying memory buffer with a clone queued to an AF_PACKET socket. When such a shared packet is subsequently routed through a synchronous tty interface, the attempt to prepend protocol-specific headers results in writing directly into the original buffer structure rather than creating a private copy.
The operational impact of this vulnerability extends beyond simple kernel instability or crashes. Because the write operation affects memory that remains visible and potentially accessible via other network interfaces, specifically AF_PACKET sockets, an attacker with local access could exploit this condition to corrupt data intended for monitoring tools or packet capture applications. This constitutes a violation of data integrity principles and can lead to information leakage if sensitive payloads are overwritten or altered before being delivered to the socket consumer. Furthermore, depending on memory layout and heap state, such out-of-bounds writes might facilitate arbitrary code execution by overwriting critical kernel structures adjacent to the buffer in memory.
From a classification perspective, this flaw aligns with CWE-787 Out-of-Bounds Write, as it involves writing data beyond the intended boundaries of allocated or protected memory regions due to insufficient checks on write permissions and ownership. It also relates to CWE-665 Improper Initialization regarding the assumption that standard transmission paths provide necessary protections without explicit verification in bridging contexts. In terms of attack vectors, this vulnerability supports techniques associated with privilege escalation through local exploitation, fitting within MITRE ATT&CK tactics related to Defense Evasion by masking malicious activity via legitimate kernel processes and potentially Impact categories involving Data Manipulation or System Availability if the corruption leads to a denial of service condition.
The resolution implemented in the Linux kernel addresses this issue by integrating skb_cow_head() calls into the ppp_sync_txmunge() function prior to any header manipulation. This ensures that both sufficient headroom is available and, crucially, that the socket buffer header is made writable through proper copy-on-write mechanisms if it was previously shared or read-only. By enforcing this check regardless of whether the packet arrived via standard transmission paths or bridging routes, the kernel guarantees memory isolation between different network consumers. Administrators should ensure their systems are updated with patches containing this fix to prevent potential exploitation by local attackers seeking to compromise system integrity or exfiltrate data through manipulated network buffers.