UBUNTU-CVE-2026-98377: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlaninsertinnertag() vlaninsertinnertag() only guarantees head room via skbcowhead(), never that maclen bytes of MAC header are present. Its ETHHLEN wrappers - vlaninserttag() under skbvlanpush(), and vlaninserttag() under validatexmitvlan() on the generic transmit path - therefore rewrite the first 16 bytes at skb->data: a 12-byte memmove plus two 2-byte stores at +12 and +14. No caller supplies the bound, while the pop helpers use skbensurewritable()/pskbmaypull(). An IFFTUN device has hardheaderlen == 0, so packetsnd() accepts a one-byte AFPACKET/SOCKRAW frame. The first vlan push only sets a hwaccel tag; the next - clsact "action vlan push" or bpfskbvlanpush() - enters the helper with skb->len still 1. The head comes from skbuffsmallhead without GFPZERO, so each push drags bytes from beyond skb->tail into the frame. After three the one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised slab: 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81 ------------------------------' only 0x5a was sent; the rest is slab, here the top 56 bits of a linear-map address Require the MAC header the helper rewrites to be present, so such a frame is dropped rather than transmitted.