CVE-2026-90078

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

syzbot reported a warning in skb_network_header_len() triggered

by tcf_skbmod_act():

!skb_transport_header_was_set(skb)

WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline]

WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55

There are a few issues in tcf_skbmod_act():

1. Calling skb_network_header_len() assumes skb->transport_header is set,

which is not guaranteed when tcf_skbmod_act() runs at TC ingress.

2. Unconditionally calling skb_mac_header_len() at the beginning of

tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the

MAC header is unset, evaluating to an underflowed garbage length.

3. On TC ingress, skb->data points to the network header. Adding the MAC

header length to t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References