CVE-2026-97964: ppp_synctty: ensure a writeable skb header
In the Linux kernel, the following vulnerability has been resolved:
pppsynctty: ensure a writeable skb header
pppsynctxmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through pppstartxmit(), which calls skbcowhead().
For example, a PPPoE frame may share its buffer with a clone queued to an AFPACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket.
Use skbcowhead() to ensure both sufficient headroom and a writable header.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel with PPP channel bridging to a synchronous tty channel are exposed when a received skb can reach the synchronous transmit path without first passing through ppp_start_xmit(). The described example involves PPPoE traffic whose buffer is shared with a clone queued to an AF_PACKET socket.
What must happen for exploitation or impact to occur?
A received packet with a shared skb buffer must be bridged to a synchronous tty channel. The transmit path then prepends PPP address and control bytes without ensuring that the skb header is writable, potentially overwriting data still visible through the shared clone.
What is the security impact?
The issue can corrupt packet data visible to an AF_PACKET socket when the original PPPoE skb buffer is shared with a queued clone. The provided information describes data overwrite in the shared buffer, not code execution or privilege escalation.
How is the issue fixed?
The fix replaces the headroom-only handling with skb_cow_head(), which ensures both adequate headroom and a writable skb header before address and control bytes are prepended.