VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90083: Linux kernel · net/sched: act_ife: Only operate on Ethernet frames

Source GCVE Database

Compare

Authoritative record:CVE-2026-90083· High

Not known to be exploited · fixed in d218ea7df6eba076171f2d4897a429a31f2139f0 : patch Linux kernel soon.

Data as of 30 Oct 2026, 19:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in d218ea7df6eba076171f2d4897a429a31f2139f0, b951dd2fd5ede007474fc134ecb5639e1f86f5de, 138b0054021fd7d57bc3eb68b3f4e2bcec037849 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-28qx-7jq4-9v6v

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < d218ea7df6eba076171f2d4897a429a31f2139f0	Fixed in d218ea7df6eba076171f2d4897a429a31f2139f0
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < b951dd2fd5ede007474fc134ecb5639e1f86f5de	Fixed in b951dd2fd5ede007474fc134ecb5639e1f86f5de
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 138b0054021fd7d57bc3eb68b3f4e2bcec037849	Fixed in 138b0054021fd7d57bc3eb68b3f4e2bcec037849
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 13dddf87a1f89557920f9b437a21ea0b7225f828	Fixed in 13dddf87a1f89557920f9b437a21ea0b7225f828
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 5b483f7791b079bb97d411f1066652ff659207ff	Fixed in 5b483f7791b079bb97d411f1066652ff659207ff
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 3c07621770b04f19b67e3af4a24b4d447826fbdd	Fixed in 3c07621770b04f19b67e3af4a24b4d447826fbdd

AI-suggested

A patch has been applied to the Linux kernel that restricts the act_ife module to operate only on Ethernet frames, dropping packets without Ethernet headers. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.

Description

CVE-2026-90083 is a Linux kernel vulnerability in the net/sched act_ife module that mishandles non-Ethernet frames. The flaw arises because act_ife assumes skb->dev->hard_header_len corresponds to the Ethernet header length, which is incorrect for non-Ethernet devices like PPP. This can cause skb_under_panic kernel crashes when headroom is tight. The patch restricts act_ife to operate only on Ethernet frames and drops packets without Ethernet headers to prevent out-of-bounds memory operations and kernel panics.

References

Community reviews

Loading reviews…