CVE-2026-99066 is a vulnerability in Linux Kernel
Published on October 23, 2026
can: dev: init_can_skb(): restore skb header initialization
In the Linux kernel, the following vulnerability has been resolved:
can: dev: init_can_skb(): restore skb header initialization
Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
removed the skb_reset_mac_header()/skb_reset_network_header()/
skb_reset_transport_header() calls from init_can_skb(). As a result, RX
skbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.
When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length
calculation overflows and triggers skb_under_panic -> kernel BUG -> full
machine panic.
The same issue was originally reported in 2014 on linux-can and fixed by
commit 969439016d2c ("can: add missing initialisations in CAN related
skbuffs"). packet_rcv_spkt() itself has never been hardened: only
packet_rcv() and tpacket_rcv() gained dev_has_header() checks in
commit d549699048b4 ("net/packet: fix packet receive on L3 devices
without visible hard header").
Products Associated with CVE-2026-99066
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 9f10374bb024593a611e6845847f0444841a231b and below 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632 is affected.
- Version 9f10374bb024593a611e6845847f0444841a231b and below 0a04c0cb8606ff88399489d03ef255afe90d0d5f is affected.
- Version 7.0 is affected.
- Before 7.0 is unaffected.
- Version 7.2.11, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.