In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt()… (CVE-2026-99033)

The Linux kernel vulnerability (CVE-2026-99033) involves the packet_rcv_spkt() function in net/packet, which restores the link layer header without checking if the device has a visible link layer header. Devices like CAN interfaces can leave skb->mac_header at an invalid sentinel value, causing skb_push() to calculate a large negative length and trigger a kernel panic. While packet_rcv() and tpacket_rcv() use dev_has_header() to guard this operation, packet_rcv_spkt() did not, leading to this flaw. The issue was introduced in commit d549699048b4 and affects packet sockets (SOCK_PACKET) bound to CAN interfaces. The fix adds the missing guard to prevent the panic, ensuring stable operation when receiving packets on such devices.

This vulnerability can cause a kernel panic (system crash) when a packet socket receives a packet on a device without a visible link layer header, such as a CAN interface. This results in a denial of service due to the kernel panic triggered by skb_push() detecting an invalid length. The vulnerability affects systems using packet sockets with CAN devices and can be triggered without elevated privileges beyond CAP_NET_RAW.

A fix is available that adds the missing guard in packet_rcv_spkt() to prevent the kernel panic. Users should apply the official kernel patch that resolves this issue. Until patched, avoid using packet sockets bound to CAN interfaces or devices without visible link layer headers to prevent triggering the panic.