CVE-2026-99033 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net/packet: guard the ll header push in packet_rcv_spkt()
packet_rcv_spkt() restores the link layer header with
skb_push(skb, skb->data - skb_mac_header(skb));
That subtraction is only meaningful when the device actually has a link layer header. packet_rcv() and tpacket_rcv() both wrap it in dev_has_header(), which is also the predicate the block comment at the top of the file states the restore in terms of; packet_rcv_spkt() does not. commit d549699048b4 ("net/packet: fix packet receive on L3 devices without visible hard header") introduced the helper and changed the two call sites, and this one stayed behind.
A device without a visible ll header can leave skb->mac_header at the 0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does: init_can_skb() sets pkt_type and ip_summed but does not reset the headers, and commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") dropped the skb_reset_*_header() calls that used to be there. skb_mac_header() is then 0xFFFF, the length becomes a large negative number and skb_push() reports it through skb_under_panic() -- from softirq context, so it is a full system panic even with panic_on_oops=0:
skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0 kernel BUG at net/core/skbuff.c:214! RIP: 0010:skb_panic+0x50/0x60 Call Trace: <IRQ> skb_push+0x38/0x40 packet_rcv_spkt+0xe1/0x170 __netif_receive_skb_core.constprop.0+0x7e8/0xd30 ... Kernel panic - not syncing: Fatal exception in interrupt
The socket type is reachable: packet_create() accepts SOCK_PACKET alongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check, and neither the socket length nor a capability check keeps it away from a CAN interface.
The missing skb_reset_*_header() calls in init_can_skb() are a regression in their own right and are being fixed separately, but a packet socket should not turn a link layer that did not initialise its mac header into a kernel panic. Guard the push the way the other two receive paths do.
Tested on v7.3-rc5 under QEMU with a slcan device on a pty, which is the driver RX path: vcan does not reproduce it, because can_send() resets the headers on the way out. One SOCK_PACKET socket bound to can0 and one frame written into the line discipline panics an unpatched kernel with the trace above; the same image with this patch prints no panic and powers off normally. Both kernels are this tree, defconfig plus CONFIG_CAN_SLCAN=y, differing only in this hunk.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a critical vulnerability within the packet socket implementation that allows for a local denial of service condition through a kernel panic. The issue resides specifically in the packet_rcv_spkt function, which is responsible for restoring link layer headers on received network packets. While other receive paths such as packet_rcv and tpacket_rcv correctly check whether the device possesses a visible link layer header before attempting to manipulate buffer pointers using dev_has_header, this specific code path lacks that safeguard. This inconsistency was introduced when commit d549699048b4 added helper functions for handling devices without hard headers but failed to update all relevant call sites, leaving packet_rcv_spkt exposed to improper memory operations under certain conditions.
The technical root cause involves the manipulation of socket buffer pointers where skb_mac_header is expected to point to a valid link layer header location. When processing packets from network interfaces that do not provide visible hard headers, such as Controller Area Network devices configured via slcan drivers, the mac_header field remains at its initial sentinel value of 0xFFFF set by __alloc_skb. Because init_can_skb does reset certain packet type fields but fails to initialize header pointers due to a regression in commit 9f10374bb024 which removed private CAN skb headroom infrastructure calls, the subsequent subtraction operation results in a large negative length value. This invalid calculation triggers an overflow condition that causes skb_push to invoke skb_under_panic, leading directly to a fatal kernel exception within softirq context regardless of panic_on_oops settings.
From an operational impact perspective, this vulnerability enables any user with CAP_NET_RAW capabilities to crash the entire system by sending specific frames through CAN interfaces bound to SOCK_PACKET sockets. The attack vector is particularly dangerous because it occurs during interrupt handling, making recovery impossible without a hard reset. This represents a significant availability risk for systems relying on CAN bus communication or virtualized environments simulating such hardware via pty devices like slcan. The vulnerability affects kernel versions prior to the application of this fix and can be reproduced in testing environments using QEMU with appropriate configuration flags enabled, demonstrating that even unprivileged users capable of creating raw network sockets can trigger system-wide failures.
This flaw aligns with CWE-190 Integer Overflow or Wraparound as it stems from arithmetic operations producing invalid negative values due to improper initialization checks. It also relates to CWE-252 unchecked return value since the code assumes successful header restoration without verifying device capabilities first. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Local Privilege Escalation through Denial of Service by exploiting kernel memory management routines via network interface interactions. The attack pattern corresponds to techniques involving exploitation of software flaws within operating system components rather than application layer vulnerabilities.
Mitigation strategies require applying the upstream patch that guards the link header push operation with appropriate device capability checks similar to those used in other packet receive functions. System administrators should ensure their kernels are updated to include this fix, particularly if they utilize CAN bus interfaces or virtualized network devices capable of generating packets without standard Ethernet headers. Additionally, organizations deploying critical infrastructure involving automotive protocols or industrial control systems connected via CAN networks must prioritize patching these kernel components to prevent potential service disruptions caused by malicious actors exploiting the missing validation logic in packet socket handling routines.