In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024… (CVE-2026-99066)

The vulnerability in the Linux kernel CAN subsystem arises from the removal of skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() calls in the init_can_skb() function. This causes received socket buffers (skbs) allocated by alloc_can_skb() to have mac_header set to 0xFFFF. When such skbs reach the packet_rcv_spkt() function (used by SOCK_PACKET sockets), the push length calculation overflows, triggering skb_under_panic and causing a kernel BUG that leads to a full machine panic. This issue was originally fixed in 2014 but was reintroduced by commit 9f10374bb024. The packet_rcv_spkt() function lacks hardening checks present in other packet receive functions, contributing to the vulnerability.

Exploitation of this vulnerability causes a kernel panic resulting in a full system crash, effectively a denial of service condition. There is no indication of code execution or privilege escalation. The impact is limited to system stability and availability.

A fix is available as the vulnerability has been resolved by restoring the skb header initialization in the Linux kernel source. Users should apply the official kernel update that includes commit 9f10374bb024 or later to remediate this issue. No additional mitigations are indicated.