CVE-2026-98375: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98375 Overview

CVE-2026-98375 affects the Linux kernel's Xen paravirtualized network frontend driver (xen/netfront). The flaw lives in handle_incoming_queue(), which pulls pull_to bytes into the socket buffer head before calling eth_type_trans(). The driver trusts the slot length reported by the backend and never validates it against ETH_HLEN.

A malicious or malfunctioning Xen backend can deliver RX packets whose first slot is shorter than an Ethernet header. This triggers a BUG() inside __skb_pull() or causes eth_type_trans() to read past the end of the data buffer in the guest kernel.

Critical Impact
A hostile Xen network backend can crash guest kernels via a BUG() in __skb_pull() or trigger an out-of-bounds read in eth_type_trans(), resulting in guest denial of service.

Affected Products

Linux kernel builds that enable the Xen paravirtualized network frontend driver (xen-netfront)
Linux guests running under Xen hypervisors with untrusted or compromised network backends
Stable kernel branches referenced by commits 089e588, 236a17c, 72d2f54, and e2b721b

Discovery Timeline

2026-10-09 - Vulnerability disclosed through the Xen Project Advisory XSA-522 and the Openwall OSS Security list
2026-10-09 - CVE-2026-98375 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-98375

Vulnerability Analysis

The xen-netfront driver reassembles incoming packets from one or more RX slots provided by the backend. In handle_incoming_queue(), the driver calls a pull helper to copy pull_to bytes into the linear portion of the socket buffer before dispatching the packet to eth_type_trans(). The variable pull_to is derived from the length of the first RX slot, capped at RX_COPY_THRESHOLD.

The driver never compares pull_to against ETH_HLEN (14 bytes). When the first slot is shorter than an Ethernet header and additional slots follow, the linear head is shorter than ETH_HLEN while skb->len reflects the full packet. eth_type_trans() then calls __skb_pull() with an argument exceeding the head length, triggering a kernel BUG(). When the entire packet is shorter than ETH_HLEN, eth_type_trans() reads header bytes past the end of the buffer. The return value of the earlier pull operation was also discarded, so allocation failures went undetected.

Root Cause

The root cause is missing input validation on backend-supplied length metadata, falling under [CWE-20] Improper Input Validation and manifesting as an Out-of-Bounds Read combined with a reachable BUG() assertion in the receive path.

Attack Vector

Exploitation requires a malicious or compromised Xen network backend able to craft RX descriptors with undersized first slots. The attacker does not need authenticated access to the guest. Delivering a crafted packet to a vulnerable guest triggers the kernel assertion or out-of-bounds read, causing a guest kernel crash and denial of service.

See the Xen Project advisory XSA-522 for backend trust model details.

Detection Methods for CVE-2026-98375

Indicators of Compromise

Kernel panic messages referencing __skb_pull, eth_type_trans, or handle_incoming_queue in guest dmesg output
Repeated guest VM crashes or reboots coinciding with network traffic from a specific backend domain
KASAN or similar memory sanitizer reports flagging out-of-bounds reads inside eth_type_trans()

Detection Strategies

Monitor guest kernel crash telemetry for BUG() traces originating in net/ethernet/eth.c or drivers/net/xen-netfront.c
Correlate guest reboots with Xen backend (netback) driver activity or domain reconfiguration events
Review kernel version inventories against the patched commits 089e588, 236a17c, 72d2f54, and e2b721b

Monitoring Recommendations

Centralize guest dmesg and crash dump collection for Xen-hosted Linux workloads
Alert on anomalous RX slot sizes or malformed Ethernet frames if backend-side instrumentation is available
Track package versions of linux-image-* across Xen guest fleets to confirm patch coverage

How to Mitigate CVE-2026-98375

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits 089e588, 236a17c, 72d2f54, and e2b721b
Rebuild or upgrade affected Xen guest kernels and reboot to activate the patched xen-netfront driver
Review the Xen Project Advisory XSA-522 for distribution-specific guidance

Patch Information

The fix updates handle_incoming_queue() to pull at least ETH_HLEN bytes into the linear head and to check the return value of the pull operation. Packets that cannot satisfy this minimum are dropped, which also discards frames shorter than an Ethernet header. Stable kernel series have received backports under the commit hashes listed above.

Workarounds

Restrict Xen guests to trusted network backend domains until kernels are patched
Isolate untrusted workloads on separate hosts to reduce exposure of unpatched guests to malicious netback instances
Where feasible, disable xen-netfront and use alternative network drivers in high-risk guest configurations