CVE-2026-89780: Linux Kernel rmnet Privilege Escalation

CVE-2026-89780 Overview

CVE-2026-89780 is a null pointer dereference vulnerability in the Linux kernel's Qualcomm rmnet driver. The flaw resides in rmnet_map_deaggregate(), which allocates each sub-frame using alloc_skb() and leaves skb->dev set to NULL. When a MAP command frame is dispatched to rmnet_map_command() before __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev, the subsequent rmnet_map_send_ack() call invokes netif_tx_lock(skb->dev) on a NULL device pointer. This triggers a kernel panic.

Critical Impact
An unprivileged local user can trigger a kernel panic by unsharing a user and network namespace, creating an rmnet link over a tap device, and writing a crafted aggregated frame containing a flow-control command.

Affected Products

Linux kernel (Qualcomm rmnet driver)
Systems where unprivileged user namespaces are enabled
Kernel versions affected by commit 378e25357ac7 prior to the referenced fix commits

Discovery Timeline

2026-09-16 - CVE-2026-89780 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89780

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Qualcomm rmnet network driver. The rmnet_map_deaggregate() function splits an aggregated MAP frame into individual skbs using alloc_skb(). Freshly allocated skbs have skb->dev initialized to NULL.

On the data path, __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev before further processing. However, MAP command frames follow a different code path. They are dispatched directly to rmnet_map_command() without the device assignment happening first.

When rmnet_map_send_ack() runs netif_tx_lock(skb->dev), the kernel attempts to acquire a spinlock at offset 0x4b4 from a NULL base address. This is confirmed by the KASAN report showing null-ptr-deref in _raw_spin_lock at addr 00000000000004b4. The resulting fault occurs in interrupt context and produces a fatal kernel panic.

Root Cause

The root cause traces back to commit 378e25357ac7, which removed a previous assignment of skb->dev in the deaggregation path. Without this assignment, MAP command frames reach rmnet_map_command() with an uninitialized device pointer. The fix restores the assignment so every skb leaving rmnet_map_deaggregate() has a valid dev reference.

Attack Vector

An unprivileged user reaches the vulnerable code by:

Unsharing a user and network namespace using unshare(CLONE_NEWUSER | CLONE_NEWNET).
Creating a tap device inside the new namespace.
Creating an rmnet link over the tap device with the INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS flags set.
Writing an aggregated MAP frame carrying a flow-control command to the tap file descriptor.

The crafted frame is processed by tun_get_user() and passes through netif_receive_skb() into rmnet_rx_handler(), ultimately reaching rmnet_map_command() where the dereference occurs. The result is a denial of service through kernel panic.

Detection Methods for CVE-2026-89780

Indicators of Compromise

Kernel oops or panic messages referencing rmnet_map_command, rmnet_map_send_ack, or netif_tx_lock in dmesg output.
KASAN reports showing null-ptr-deref in _raw_spin_lock with a write to address 0x4b4.
Unexpected creation of rmnet interfaces layered over tun/tap devices in unprivileged user namespaces.

Detection Strategies

Audit unshare() and clone() syscalls with CLONE_NEWUSER and CLONE_NEWNET flags initiated by unprivileged processes.
Monitor rtnetlink events for creation of rmnet link types by non-root users.
Correlate tap device creation with subsequent rmnet interface configuration to identify exploitation patterns.

Monitoring Recommendations

Enable kernel crash logging via kdump and forward panic traces to a centralized log platform for analysis.
Alert on repeated kernel oops events referencing Qualcomm rmnet driver symbols.
Track process behavior involving namespace creation followed by network interface manipulation.

How to Mitigate CVE-2026-89780

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commits as soon as vendor builds are available.
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where operationally feasible.
Unload or blacklist the rmnet module on systems that do not require Qualcomm modem aggregation support.

Patch Information

The fix has been merged across multiple stable kernel branches. The relevant commits are 200460a0793d, 4bcef54e4a33, 5aaa7409c1b4, 7abe769e72c7, 9b78ab84ddf9, 9d18c6c6cd16, a66734a1c5e3, and b14c22c31d9e. Each commit restores the skb->dev assignment in the deaggregation path. See the Kernel Git Commit 200460a0793d and related references for the full patch set.

Workarounds

Disable unprivileged user namespaces via sysctl: sysctl -w kernel.unprivileged_userns_clone=0.
Blacklist the rmnet kernel module on systems that do not use Qualcomm MAP aggregation.
Restrict access to /dev/net/tun through filesystem permissions or Linux Security Modules such as AppArmor or SELinux.

bash

# Configuration example
# Disable unprivileged user namespace creation
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Blacklist the rmnet module if not required
echo 'blacklist rmnet' | sudo tee /etc/modprobe.d/blacklist-rmnet.conf
sudo update-initramfs -u