{"id":"CVE-2026-98375","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans().  pull_to is the l…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-125"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:18:12.323","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98375","references":[{"url":"https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/09/3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://xenbits.xen.org/xsa/advisory-522.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98375.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98375"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548385"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98375"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98375"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98375.mbox"},{"url":"https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00186,"epssPercentile":0.08123,"cvssSource":"vendor","ingestedAt":"2026-10-09T08:29:41.346Z","slug":"CVE-2026-98375","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans().  pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb->len is longer,\nand eth_type_trans() BUG()s in __skb_pull().  If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header.  This also checks\nthe return value of the pull, which was ignored.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98375.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219113,"id":"CVE-2026-98375","ts":1791707065292,"field":"cvss","old":null,"new":"7"},{"seq":219112,"id":"CVE-2026-98375","ts":1791707065292,"field":"severity","old":"none","new":"high"}]}