Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN. If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead. Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3822

  Linux Kernel: Multiple vulnerabilities allow an unspecified attack Translated from German

  CVE-2026-98380CVE-2026-98376CVE-2026-98381+7 more CVEs
• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3826

  Xen: Vulnerability allows denial of service Translated from German

  CVE-2026-98375

[ References ]References

• git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5
• git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801
• git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40
• git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067
• git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e
• www.openwall.com/lists/oss-security/2026/10/09/3
• xenbits.xen.org/xsa/advisory-522.html