CVE-2026-98554: vlan: ensure sufficient headroom in vlan_dev_hard_header()
In the Linux kernel, the following vulnerability has been resolved:
vlan: ensure sufficient headroom in vlandevhardheader()
Callers that only reserve ETHHLEN or less (such as llcallocframe()), or skbs allocated before dynamic device/headroom changes (e.g. toggling VLANFLAGREORDERHDR or bonding/team switching slaves), can reach vlandevhardheader() with insufficient headroom and trigger skbunderpanic().
Use skbcowhead() in vlandevhardheader() when VLANFLAGREORDERHDR is not set to ensure sufficient headroom for the VLAN header(s) and the underlying device hard header.
Use READONCE() to read dev->hardheaderlen and dev->neededheadroom as they can be updated concurrently under RTNL (e.g. in vlantransferfeatures()) while vlandevhardheader() runs locklessly on the transmit path. Also avoid LLRESERVEDSPACE(dev) here so that the extra HHDATAMOD alignment padding does not trigger unnecessary pskbexpandhead() reallocations on inner stacked VLAN devices after the outer VLAN header has been pushed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update vlan_dev_hard_header() to use skb_cow_head() when VLAN_FLAG_REORDER_HDR is not set, use READ_ONCE() when reading dev->hard_header_len and dev->needed_headroom, and avoid LL_RESERVED_SPACE(dev) for callers that reserve ETH_HLEN or less.