CVE-2026-97964
Received Received - Intake

ppp_synctty: Insufficient Headroom in skb Header

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ppp_synctty: ensure a writeable skb header ppp_sync_txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which calls skb_cow_head(). For example, a PPPoE frame may share its buffer with a clone queued to an AF_PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket. Use skb_cow_head() to ensure both sufficient headroom and a writable header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97964
EUVD
EUVD-2026-86818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ppp_synctty module where the ppp_sync_txmunge() function fails to ensure the skb header is writable before modifying it. This can allow a received skb, potentially shared with other network buffers, to overwrite data visible to other sockets, leading to data corruption or exposure.

Detection Guidance

Detection of this vulnerability requires checking for affected Linux kernel versions and inspecting PPP-related configurations. Use uname -a to check your kernel version and grep for PPP modules with lsmod | grep ppp. Monitor network traffic for unusual patterns involving PPPoE frames or AF_PACKET socket interactions.

Impact Analysis

This vulnerability could allow an attacker to corrupt network data or expose sensitive information by manipulating shared network buffers. Systems using PPP channel bridging or PPPoE frames may be particularly affected, potentially leading to data leaks or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or corruption, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Organizations must address this flaw to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Apply the latest kernel patches from your distribution to resolve the issue. If patching is not immediately possible, disable PPP channel bridging or synchronous tty usage as a workaround. Monitor for suspicious network activity or data corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart