All vulnerabilities
CVE-2026-99066

Linux: can: dev: init_can_skb(): restore skb header initialization

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632Also 0a04c0cb8606ff88399489d03ef255afe90d0d5fCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632LinuxCVE List
  • 0a04c0cb8606ff88399489d03ef255afe90d0d5fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

can: dev: init_can_skb(): restore skb header initialization

Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") removed the skb_reset_mac_header()/skb_reset_network_header()/ skb_reset_transport_header() calls from init_can_skb(). As a result, RX skbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF. When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length calculation overflows and triggers skb_under_panic -> kernel BUG -> full machine panic.

The same issue was originally reported in 2014 on linux-can and fixed by commit 969439016d2c ("can: add missing initialisations in CAN related skbuffs"). packet_rcv_spkt() itself has never been hardened: only packet_rcv() and tpacket_rcv() gained dev_has_header() checks in commit d549699048b4 ("net/packet: fix packet receive on L3 devices without visible hard header").

Text from CVE List

Affected versions 6

  • Linuxaffected: 9f10374bb024593a611e6845847f0444841a231b before 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632CVE List
  • Linuxaffected: 9f10374bb024593a611e6845847f0444841a231b before 0a04c0cb8606ff88399489d03ef255afe90d0d5fCVE List
  • Linuxaffected: 7.0CVE List
  • Linuxunaffected: all versions before 7.0CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2