All vulnerabilities
CVE-2026-98287

Linux: pppoatm: ensure a writable skb header and linear data

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in208ccc4d08b1897451e9ba01c016bf93ff107966Also 8e66c5969acd859ba72fb0a7fa895623fc1b3769, 30992fe39e65589ed8e000425e088fa74994b811CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 208ccc4d08b1897451e9ba01c016bf93ff107966LinuxCVE List
  • 8e66c5969acd859ba72fb0a7fa895623fc1b3769LinuxCVE List
  • 30992fe39e65589ed8e000425e088fa74994b811LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

pppoatm: ensure a writable skb header and linear data

In pppoatm_send(), LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable.

Normal transmit packets passing through ppp_start_xmit() have their header unshared via skb_cow_head(). However, packets can also reach pppoatm_send() via PPP channel bridging (PPPIOCBRIDGECHAN) without going through ppp_start_xmit().

Use skb_cow_head() to ensure both sufficient headroom and a writable header before pushing the LLC header.

While at it:

  • Call pskb_may_pull(skb, 1) before inspecting skb->data[0] to prevent

out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging).

  • Defer SC_COMP_PROT protocol compression until after pppoatm_may_send()

succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skb_push().

Text from CVE List

Affected versions 16

  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 208ccc4d08b1897451e9ba01c016bf93ff107966CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before e6cd1bba7d113c15c00ac63671213a096fe4d686CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before ffc448eb54f5ba80d4212c1e870cdb92b0f709faCVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 8e66c5969acd859ba72fb0a7fa895623fc1b3769CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before e2f5529b0016db7d34f411408607f5cf395a542eCVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before 30992fe39e65589ed8e000425e088fa74994b811CVE List
  • Linuxaffected: 4cf476ced45d7f12df30a68e833b263e7a2202d1 before ecc7253683a3c55caa868ce0ee530fcb0044bd3cCVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7