All vulnerabilities
CVE-2026-97964

Linux: ppp_synctty: ensure a writeable skb header

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in25e03eeead2c49748c7582dfb64c205f93a42d00Also 7953946f68262a8bb137aa101249adef6e029652, 3af7797fbabc84992e0ca5ad2bc0ca8537d053ef and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 25e03eeead2c49748c7582dfb64c205f93a42d00LinuxCVE List
  • 7953946f68262a8bb137aa101249adef6e029652LinuxCVE List
  • 3af7797fbabc84992e0ca5ad2bc0ca8537d053efLinuxCVE List
  • 0996c3e6bcc6ae08cb371ed43648c9f7f748ae6eLinuxCVE List
  • 15d0a6c9a42df2d745c37510dba828f6dbe60d9fLinuxCVE List
  • 8aaeb56aff2a557a88f83ae866da2c91ad247e59LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ppp_synctty: ensure a writeable skb header

ppp_sync_txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which calls skb_cow_head().

For example, a PPPoE frame may share its buffer with a clone queued to an AF_PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket.

Use skb_cow_head() to ensure both sufficient headroom and a writable header.

Text from CVE List

Affected versions 16

  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 25e03eeead2c49748c7582dfb64c205f93a42d00CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before a256f9925288ef47de8febed5c38d5cc21340211CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 7953946f68262a8bb137aa101249adef6e029652CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 3af7797fbabc84992e0ca5ad2bc0ca8537d053efCVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 0996c3e6bcc6ae08cb371ed43648c9f7f748ae6eCVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 15d0a6c9a42df2d745c37510dba828f6dbe60d9fCVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 8aaeb56aff2a557a88f83ae866da2c91ad247e59CVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7