CVE-2026-98375

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: drop RX packets with a short Ethernet header

handle_incoming_queue() pulls pull_to bytes into the head before

calling eth_type_trans(). pull_to is the length of the first RX slot,

capped at RX_COPY_THRESHOLD, and that length comes from the backend.

Nothing checks it against ETH_HLEN.

If the first slot is shorter than ETH_HLEN and more slots follow, the

head ends up shorter than an Ethernet header while skb->len is longer,

and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is

shorter than ETH_HLEN, eth_type_trans() reads the header past the end

of the data instead.

Pull at least ETH_HLEN, and drop the packet if that fails, which also

drops packets too short to hold an Ethernet header. This also checks

the return value of the pull, which was ignored.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References