SB20261022131 - Incorrect Calculation of Buffer Size in Linux kernel 8021q
Published: October 22, 2026
Security Bulletin ID
SB20261022131
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98554)
CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.
The vulnerability exists due to insufficient packet buffer headroom in vlan_dev_hard_header() when constructing VLAN headers with VLAN_FLAG_REORDER_HDR unset. A local user can trigger packet transmission using buffers with insufficient reserved headroom to cause an skb_under_panic() kernel panic.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/4ba1f57313f36a3ce6f77d593548f0c511f34aa1
- https://git.kernel.org/stable/c/55e007fc3b4d76fa4d6b4660f6904fe6ab045a1b
- https://git.kernel.org/stable/c/5aca8e6a8ff6aeae358c1d9b65447aac416ace95
- https://git.kernel.org/stable/c/90d51095371d96747f45bbd8504edf6513e039ef
- https://git.kernel.org/stable/c/c7ee4bea64f559ea8e03260014775b64c720cb5b
- https://git.kernel.org/stable/c/ca797491f0ae4bfde9039f79f6f1ed7781c9110f
- https://git.kernel.org/stable/c/cd5dd68267c4238795fadaf02b3575ca3f8a6500
- https://git.kernel.org/stable/c/cfba0f45553de2b803059e3d539a1e418df24da8