CVE-2026-98377: Linux Kernel VLAN Buffer Overflow Vulnerability

CVE-2026-98377 Overview

CVE-2026-98377 affects the Linux kernel's VLAN handling code. The __vlan_insert_inner_tag() helper guarantees head room through skb_cow_head() but does not confirm that mac_len bytes of the MAC header are actually present. Its ETH_HLEN wrappers rewrite the first 16 bytes at skb->data without validating the socket buffer length. An attacker using an IFF_TUN device with hard_header_len == 0 can send a single-byte AF_PACKET/SOCK_RAW frame, then trigger repeated VLAN pushes to leak uninitialized slab memory onto the wire.

Critical Impact
The flaw allows a local user to exfiltrate uninitialized kernel slab contents, which may contain pointers useful for defeating kernel address space layout randomization (KASLR).

Affected Products

Linux kernel (upstream) — VLAN subsystem in net/
Distributions shipping affected stable kernel branches referenced by the fix commits
Systems using IFF_TUN devices combined with tc clsact VLAN push actions or bpf_skb_vlan_push()

Discovery Timeline

2026-10-09 - CVE-2026-98377 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98377

Vulnerability Analysis

The issue is an uninitialized memory use ([CWE-908]) in the kernel VLAN tagging path. __vlan_insert_inner_tag() performs a 12-byte memmove followed by two 2-byte stores at offsets +12 and +14 within skb->data. Callers reach this helper through __vlan_insert_tag() under skb_vlan_push() and vlan_insert_tag() on the generic transmit path through validate_xmit_vlan(). Neither path verifies that the MAC header the helper rewrites is actually present in the socket buffer.

A packet socket on an IFF_TUN device accepts frames as small as one byte because hard_header_len is zero. When subsequent VLAN pushes execute against that frame, the helper reads and relocates bytes beyond the submitted payload. The backing allocation comes from skbuff_small_head without __GFP_ZERO, so the trailing bytes contain residual slab contents from prior allocations.

Root Cause

The root cause is a missing length precondition. skb_cow_head() only ensures writable head room; it does not guarantee that mac_len bytes of MAC header exist within the linear data area. The pop counterparts correctly use skb_ensure_writable() and pskb_may_pull(), but the push path omits the equivalent check.

Attack Vector

A local, unprivileged process with the ability to open an AF_PACKET socket on an IFF_TUN device sends a one-byte SOCK_RAW frame. A first VLAN push sets only the hardware-accelerated tag. A second push through a clsactaction vlan push rule or an eBPF program calling bpf_skb_vlan_push() invokes the vulnerable helper while skb->len is still 1. Each push drags bytes from beyond skb->tail into the transmitted frame. In the reporter's reproduction, three pushes produced a 13-byte frame containing 11 bytes of uninitialized slab, including the top 56 bits of a linear-map address useful for KASLR defeat.

See the upstream fix at kernel.org commit ab888242fce4 for the authoritative patch description.

Detection Methods for CVE-2026-98377

Indicators of Compromise

Unexpected creation of tun/tap devices by non-administrative users on multi-tenant hosts.
tc filter programming that chains action vlan push on interfaces with hard_header_len == 0.
Loading of unsigned or unexpected eBPF programs that invoke bpf_skb_vlan_push() helpers.

Detection Strategies

Audit kernel versions against the fixed commits (40a5cc4b7251, 59af43ccece4, ab888242fce4, f42562dd027d) to confirm patch presence.
Monitor AF_PACKET/SOCK_RAW socket creation combined with VLAN tagging activity by unprivileged UIDs.
Enable kernel hardening options such as init_on_alloc=1 so that stale slab contents are zeroed before reuse, which prevents the information disclosure outcome.

Monitoring Recommendations

Capture auditd events for socket(AF_PACKET, SOCK_RAW, ...) and correlate with tc/BPF syscall activity.
Alert on kernel BPF loads that reference VLAN push helpers from workloads that have no legitimate need for them.
Review container runtime policies that grant CAP_NET_ADMIN or CAP_NET_RAW to workloads outside the trust boundary.

How to Mitigate CVE-2026-98377

Immediate Actions Required

Apply the upstream fix that requires the MAC header to be present before __vlan_insert_inner_tag() rewrites bytes at skb->data.
Update to a stable Linux kernel release that incorporates the four referenced commits from kernel.org.
Restrict CAP_NET_ADMIN and CAP_NET_RAW to trusted administrative accounts and container workloads.

Patch Information

The fix is distributed across four stable branches. Reference commits: 40a5cc4b7251, 59af43ccece4, ab888242fce4, and f42562dd027d. The patch drops frames whose MAC header is not fully present rather than transmitting them.

Workarounds

Boot kernels with init_on_alloc=1 to zero slab allocations and prevent slab contents from leaking into transmitted frames.
Remove or disable tun/tap device access for untrusted users and containers until the patched kernel is deployed.
Deny unprivileged eBPF program loading by setting kernel.unprivileged_bpf_disabled=1.

bash

# Enable slab zero-on-allocation hardening and restrict unprivileged BPF
sudo sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-cve-2026-98377.conf

# Add init_on_alloc=1 to kernel command line via your bootloader configuration
# Example GRUB default line:
# GRUB_CMDLINE_LINUX_DEFAULT="quiet init_on_alloc=1"