Incorrect Calculation of Buffer Size in Linux kernel - CVE-2026-98554

Vulnerability identifier: #VU156857

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98554

CWE-ID: CWE-131

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to insufficient packet buffer headroom in vlan_dev_hard_header() when constructing VLAN headers with VLAN_FLAG_REORDER_HDR unset. A local user can trigger packet transmission using buffers with insufficient reserved headroom to cause an skb_under_panic() kernel panic.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/4ba1f57313f36a3ce6f77d593548f0c511f34aa1
• https://git.kernel.org/stable/c/55e007fc3b4d76fa4d6b4660f6904fe6ab045a1b
• https://git.kernel.org/stable/c/5aca8e6a8ff6aeae358c1d9b65447aac416ace95
• https://git.kernel.org/stable/c/90d51095371d96747f45bbd8504edf6513e039ef
• https://git.kernel.org/stable/c/c7ee4bea64f559ea8e03260014775b64c720cb5b
• https://git.kernel.org/stable/c/ca797491f0ae4bfde9039f79f6f1ed7781c9110f
• https://git.kernel.org/stable/c/cd5dd68267c4238795fadaf02b3575ca3f8a6500
• https://git.kernel.org/stable/c/cfba0f45553de2b803059e3d539a1e418df24da8

• Incorrect Calculation of Buffer Size in Linux kernel 8021q
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more