net/sched: act_ife: Only operate on Ethernet frames
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Only operate on Ethernet frames act_ife encapsulates/decapsulates the original Ethernet header and uses skb->dev->hard_header_len as the length of that header. That is only correct for Ethernet devices: on a device where hard_header_len does not match the L2 header that was actually pulled (PPP reports PPP_HDRLEN while nothing is stripped on ingress), the ingress skb_push()/skb_pull() use the wrong length and can hit skb_under_panic when headroom is tight. IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so instead of trying to make the offsets work for arbitrary link types, simply drop packets that do not carry an Ethernet header. Checking skb->dev->type alone is not enough. We have to cater for a corner case where mirred can redirect an skb from a non-Ethernet device to an Ethernet one, and skb->dev then says nothing about the framing the skb actually has: an skb redirected from ppp0 reaches the target's ingress hook with mac_len 0 and no Ethernet header at all. So at ingress also require mac_len to be ETH_HLEN. On egress mac_len is not maintained, so the device type is all we have; a bogus redirect there yields a malformed frame rather than an out-of-bounds push, and it would be malformed with or without IFE. That corner case is not theoretical - redirecting from ppp0 into a veth that has an ife encode a
CVE-2026-90083
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90083
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"lessThan": "b951dd2fd5ede007474fc134ecb5639e1f86f5de",
"versionType": "git"
},
{
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"lessThan": "13dddf87a1f89557920f9b437a21ea0b7225f828",
"versionType": "git"
},
{
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"lessThan": "d218ea7df6eba076171f2d4897a429a31f2139f0",
"versionType": "git"
},
{
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"lessThan": "138b0054021fd7d57bc3eb68b3f4e2bcec037849",
"versionType": "git"
},
{
"status": "affected",
"version": "295a6e06d21e1f469c9f38b00125a13b60ad4e7c",
"lessThan": "5b483f7791b079bb97d411f1066652ff659207ff",
"versionType": "git"
}
],
"programFiles": [
"net/ife/ife.c",
"net/sched/act_ife.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ife/ife.c",
"net/sched/act_ife.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90083
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48594 · Revision 1
- Added to Heist Feed
- Publisher date