CVE-2026-90083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Only operate on Ethernet frames

act_ife encapsulates/decapsulates the original Ethernet header and uses

skb->dev->hard_header_len as the length of that header. That is only

correct for Ethernet devices: on a device where hard_header_len does not

match the L2 header that was actually pulled (PPP reports PPP_HDRLEN

while nothing is stripped on ingress), the ingress skb_push()/skb_pull()

use the wrong length and can hit skb_under_panic when headroom is tight.

IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites

h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so

instead of trying to make the offsets work for arbitrary link types,

simply drop packets that do not carry an Ethernet header.

Checking skb->dev->type alone is not enough. We have to cater for a

corner case where mirred can redirect an skb from a non-Ethernet device

to an Ethernet one, and skb->dev then says n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References