VulnerabilityPublished 17 Sep 2026Updated 21 Oct 2026

CVE-2026-90083: Linux kernel · net/sched: act_ife: Only operate on Ethernet frames

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in d218ea7df6eba076171f2d4897a429a31f2139f0 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in d218ea7df6eba076171f2d4897a429a31f2139f0, b951dd2fd5ede007474fc134ecb5639e1f86f5de, 138b0054021fd7d57bc3eb68b3f4e2bcec037849 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < d218ea7df6eba076171f2d4897a429a31f2139f0	Fixed in d218ea7df6eba076171f2d4897a429a31f2139f0
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < b951dd2fd5ede007474fc134ecb5639e1f86f5de	Fixed in b951dd2fd5ede007474fc134ecb5639e1f86f5de
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 138b0054021fd7d57bc3eb68b3f4e2bcec037849	Fixed in 138b0054021fd7d57bc3eb68b3f4e2bcec037849
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 13dddf87a1f89557920f9b437a21ea0b7225f828	Fixed in 13dddf87a1f89557920f9b437a21ea0b7225f828
LinuxLinux	Affected ≥ 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, < 5b483f7791b079bb97d411f1066652ff659207ff	Fixed in 5b483f7791b079bb97d411f1066652ff659207ff
LinuxLinux	Affected =4.11	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Only operate on Ethernet frames act_ife encapsulates/decapsulates the original Ethernet header and uses skb->dev->hard_header_len as the length of that header. That is only correct for Ethernet devices: on a device where hard_header_len does not match the L2 header that was actually pulled (PPP reports PPP_HDRLEN while nothing is stripped on ingress), the ingress skb_push()/skb_pull() use the wrong length and can hit skb_under_panic when headroom is tight. IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so instead of trying to make the offsets work for arbitrary link types, simply drop packets that do not carry an Ethernet header. Checking skb->dev->type alone is not enough. We have to cater for a corner case where mirred can redirect an skb from a non-Ethernet device to an Ethernet one, and skb->dev then says nothing about the framing the skb actually has: an skb redirected from ppp0 reaches the target's ingress hook with mac_len 0 and no Ethernet header at all. So at ingress also require mac_len to be ETH_HLEN. On egress mac_len is not maintained, so the device type is all we have; a bogus redirect there yields a malformed frame rather than an out-of-bounds push, and it would be malformed with or without IFE. That corner case is not theoretical - redirecting from ppp0 into a veth that has an ife encode action on its ingress hook panics without this patch: skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000 data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3 kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657) tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874) tc_run (net/core/dev.c:4463) netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522) tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328) tcf_mirred_act (net/sched/act_mirred.c:489) tc_run (net/core/dev.c:4463) process_backlog (net/core/dev.c:6728) With Ethernet framing guaranteed, use ETH_HLEN instead of hard_header_len.

References

Community reviews

Loading reviews…