CVE-2026-89780

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and

leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns

skb->dev = ep->egress_dev only on the data path, but a MAP command frame

is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack()

runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user

reaches this by unsharing a user+net namespace, creating an rmnet link

over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS,

and writing an aggregated frame carrying a flow-control command to the

tap fd.

Restore the assignment dropped by 378e25357ac7, so every skb leaving

rmnet_map_deaggregate() has a valid device.

BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)

Write of size 4 at addr 00000000000004b4 by task exploit/144

Call Trace:

_raw_spin_lock (kernel/locki

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References