CVE-2026-99066: Linux kernel · can: dev: init_can_skb(): restore skb header initialization
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632 or 0a04c0cb8606ff88399489d03ef255afe90d0d5f soon.
Data as of 26 Oct 2026, 13:07 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632, 0a04c0cb8606ff88399489d03ef255afe90d0d5f
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632 or 0a04c0cb8606ff88399489d03ef255afe90d0d5f.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel versions identified by commits 8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632 and 0a04c0cb8606ff88399489d03ef255afe90d0d5f. Users and administrators should update to these fixed versions or later to remediate the vulnerability. No other specific mitigations are indicated.
Description
A vulnerability in the Linux kernel's CAN network subsystem caused by missing initialization of socket buffer (skb) headers in the init_can_skb() function can lead to a kernel panic. This occurs because RX skbs carry an invalid mac_header value, which triggers an overflow in packet_rcv_spkt(), resulting in a kernel BUG and full machine panic. The issue was introduced by a commit that removed skb header resets and has been fixed in later kernel versions.