CVE-2026-98158

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ppp_async: drop the errored frame instead of resetting its headroom

ppp_receive_nonmp_frame() prepends a two-byte direction tag before running

the pass/active BPF filters:

*(__be16 *)skb_push(skb, 2) = htons(PPP_FILTER_INBOUND_TAG);

Nothing on the receive path guarantees those two bytes of headroom. The

frame-error path in ppp_async's process_input_packet() resets a reused skb's

headroom to zero while claiming to restore it to a freshly allocated state -

but a fresh skb from dev_alloc_skb() carries NET_SKB_PAD:

err:

if (skb) {

/* make skb appear as freshly allocated */

skb_trim(skb, 0);

skb_reserve(skb, - skb_headroom(skb));

}

ap->rpkt still points at that skb, so the next frame is reassembled into it

with no headroom at all. A peer that sends a bad-FCS frame followed by one

beginning ff 03 then leaves a single byte of headroom by the time the filter

tag is pushed, which lands one byte below skb->h

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References