CVE-2026-90160

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

lwt_bpf: Restore reserved headroom after xmit program

ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT

xmit. An LWT_XMIT BPF program can then modify the skb head and still

return BPF_OK, so bpf_xmit() rechecks the remaining headroom before the

skb continues to neighbour output.

That recheck uses dst->dev->hard_header_len. This is not enough for the

neighbour cached-header path: neigh_hh_output() copies the cached hardware

header using the aligned hh_cache size, HH_DATA_MOD for short headers or

HH_DATA_ALIGN(hh_len) otherwise.

On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If

an LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can

still have 15 bytes of headroom after the program. The existing check

accepts that, after which neigh_hh_output() hits its headroom warning and

drops the skb.

Use LL_RESERVED_SPACE(dst->dev) in the post-BPF headroom check to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References