CVE-2026-98375 is a vulnerability in Linux Kernel
Published on October 9, 2026
xen/netfront: drop RX packets with a short Ethernet header
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
Products Associated with CVE-2026-98375
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 0d160211965b79de989cf2d170985abeb8da5ec6 and below 089e58805c452e52179482b1025a8e309a57f801 is affected.
- Version 2.6.23 is affected.
- Before 2.6.23 is unaffected.
- Version 7.3-rc7, <= * is unaffected.