CVE-2026-98158: Linux kernel · ppp_async: drop the errored frame instead of resetting its headroom
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in ff035780adb0f49dc2c7ada26b4697849a68bec8 : patch Linux kernel soon.
Data as of 26 Oct 2026, 13:47 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ff035780adb0f49dc2c7ada26b4697849a68bec8, d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da, c4bb894362d224b699e2f95c6c26707d9654e4a3 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in multiple commits to the Linux kernel. Users should update to a fixed kernel version that includes these patches. No additional mitigation is required once the patch is applied.
Description
A vulnerability in the Linux kernel's ppp_async module causes improper handling of errored frames, leading to kernel panic and potential out-of-bounds reads. The issue arises because the error path resets the skb headroom incorrectly, violating NET_SKB_PAD guarantees and causing memory corruption. This can be triggered remotely by a peer sending crafted frames, resulting in a denial-of-service (DoS) condition. The fix involves dropping errored frames instead of resetting headroom, ensuring proper skb allocation for subsequent frames.
References
- git.kernel.org/stable/c/25f354c55b8435d1f51b8a0a05a3cfe429358523 (opens in a new tab)
- git.kernel.org/stable/c/a86a17745c3e1c6fadd4d6e90c03552dfe531c8c (opens in a new tab)
- git.kernel.org/stable/c/ff035780adb0f49dc2c7ada26b4697849a68bec8 (opens in a new tab)
- git.kernel.org/stable/c/c4bb894362d224b699e2f95c6c26707d9654e4a3 (opens in a new tab)
- git.kernel.org/stable/c/d0fc3dabfe67caf084e7119ceb2ee23f5ad2f2da (opens in a new tab)
- git.kernel.org/stable/c/0c53eb14975f029abd6b26896a460f0d2aaefe6b (opens in a new tab)
- git.kernel.org/stable/c/717137221c7d90e7c98bda9a370c9da6cbf015e5 (opens in a new tab)
- git.kernel.org/stable/c/8dc5d98a16fa23c00999aecf10018c9f69fa5bf4 (opens in a new tab)