CVE-2026-98375

xen/netfront: drop RX packets with a short Ethernet header

State: Published
Severity: Not scored
Published: Oct 9, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: drop RX packets with a short Ethernet header

handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN.

If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead.

Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0d160211965b79de989cf2d170985abeb8da5ec6 to before fd5481dd75ea879c53c17882cbb065ad3bd6b766Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 9cb8813d157b4d15103d3b34c635620f36df4173Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 57508819da8dc1cf5a2c3b64570aa02cc5ae28b6Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 0542d213253eec18785a24b603b28bd385dfe4a5Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 236a17caebcff31f75bec5ff4136bde2de944e40Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 72d2f54367895d6e236b9857892e2e6b6036e067Affected 0d160211965b79de989cf2d170985abeb8da5ec6 to before e2b721bc30f40ffa7ccc36a56d4e8990b8c0538eAffected 0d160211965b79de989cf2d170985abeb8da5ec6 to before 089e58805c452e52179482b1025a8e309a57f801Affected
LinuxLinux	2.6.23Affected before 2.6.23Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0d160211965b79de989cf2d170985abeb8da5ec6 to before fd5481dd75ea879c53c17882cbb065ad3bd6b766Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 9cb8813d157b4d15103d3b34c635620f36df4173Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 57508819da8dc1cf5a2c3b64570aa02cc5ae28b6Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 0542d213253eec18785a24b603b28bd385dfe4a5Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 236a17caebcff31f75bec5ff4136bde2de944e40Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 72d2f54367895d6e236b9857892e2e6b6036e067Affected
0d160211965b79de989cf2d170985abeb8da5ec6 to before e2b721bc30f40ffa7ccc36a56d4e8990b8c0538eAffected
0d160211965b79de989cf2d170985abeb8da5ec6 to before 089e58805c452e52179482b1025a8e309a57f801Affected

LinuxLinux

2.6.23Affected
before 2.6.23Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.