CVE-2026-98554

Received Received - Intake

VLAN Header Handling Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan_dev_hard_header() Callers that only reserve ETH_HLEN or less (such as llc_alloc_frame()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach vlan_dev_hard_header() with insufficient headroom and trigger skb_under_panic(). Use skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR is not set to ensure sufficient headroom for the VLAN header(s) and the underlying device hard header. Use READ_ONCE() to read dev->hard_header_len and dev->needed_headroom as they can be updated concurrently under RTNL (e.g. in vlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on the transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the extra HH_DATA_MOD alignment padding does not trigger unnecessary pskb_expand_head() reallocations on inner stacked VLAN devices after the outer VLAN header has been pushed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98554

EUVD

EUVD-2026-103599

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where insufficient headroom in network packet headers can cause a kernel panic. The issue occurs when VLAN headers are added to packets with inadequate space, triggering skb_under_panic(). The fix involves ensuring proper headroom allocation in vlan_dev_hard_header() and using READ_ONCE() to safely read device header lengths.

Detection Guidance

This vulnerability is specific to the Linux kernel's VLAN handling and may not have direct detection commands. Monitor kernel logs for skb_under_panic() errors or VLAN-related crashes. Check if your kernel version includes the fix by running uname -r and comparing against patched versions.

Impact Analysis

If exploited, this could cause system crashes (kernel panic) during network operations involving VLANs. It may lead to denial-of-service conditions where affected systems become unresponsive. Systems using VLANs or network bonding/teaming are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel networking issue. Compliance impacts would only occur if exploitation led to data breaches or service disruptions, which is not described in the provided context.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for CVE-2026-98554. Avoid using VLAN_FLAG_REORDER_HDR or ensure sufficient headroom in VLAN operations. Monitor network traffic for unusual VLAN-related errors or crashes.

Hi! I’m here to help you understand CVE-2026-98554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70