CVE-2026-98287: pppoatm: ensure a writable skb header and linear data
In the Linux kernel, the following vulnerability has been resolved:
pppoatm: ensure a writable skb header and linear data
In pppoatmsend(), LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable.
Normal transmit packets passing through pppstartxmit() have their header unshared via skbcowhead(). However, packets can also reach pppoatmsend() via PPP channel bridging (PPPIOCBRIDGECHAN) without going through pppstartxmit().
Use skbcowhead() to ensure both sufficient headroom and a writable header before pushing the LLC header.
While at it: - Call pskbmaypull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging). - Defer SCCOMPPROT protocol compression until after pppoatmmaysend() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skbpush().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the PPPoATM transmit path to call pskb_may_pull(skb, 1) before inspecting skb->data[0], defer SC_COMP_PROT protocol compression until after pppoatm_may_send(), and use skb_cow_head() in pppoatm_send() to ensure sufficient headroom and a writable skb header before pushing the 4-byte LLC header.