Skip to content
Heist/ feed
Unrated

net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skb_network_header_len() triggered by tcf_skbmod_act(): !skb_transport_header_was_set(skb) WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline] WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55 There are a few issues in tcf_skbmod_act(): 1. Calling skb_network_header_len() assumes skb->transport_header is set, which is not guaranteed when tcf_skbmod_act() runs at TC ingress. 2. Unconditionally calling skb_mac_header_len() at the beginning of tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the MAC header is unset, evaluating to an underflowed garbage length. 3. On TC ingress, skb->data points to the network header. Adding the MAC header length to the IP header length causes skb_ensure_writable() to request more bytes than the actual IP packet length, dropping valid short packets (e.g. 28-byte UDP/IPv4 packets). Fix these by: - Using skb_network_offset(skb) + sizeof(struct iphdr/ipv6hdr) for SKBMOD_F_ECN so that the required length is correctly calculated on both ingress (offset == 0) and egress (offset == mac_len). - Setting max_edit_len to ETH_HLEN for Ethernet header modifications after validating ARPHRD_ETHER.

Announced Group revision 1
Original source ↗

CVE-2026-90078

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-90078

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "985a37781ade19061400100c2ba0f43979dd4d63",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "d896843d8d925f0adbba319020595cfb1a7bcd57",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "0675cff3c2924eb9b80d9dd250cf56a1140af157",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "e8a2027b7e686784a69b2dfcee841d779919f313",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "1719865b20b22c88d2a55e922eff5ca31b0841f6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "62126464f3a6159c0a3dd89e196ba65bfeb0afc6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "56af5e749f20c3a540310c207dcc373f4f09156e",
        "lessThan": "81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/sched/act_skbmod.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.110",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.52",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sched/act_skbmod.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-90078

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#36495 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2026-90078 · Revision 1Source updated