In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlan_dev_hard_header() Callers that only… (CVE-2026-98554)

The Linux kernel vulnerability (CVE-2026-98554) involved insufficient headroom in vlan_dev_hard_header() when callers reserved ETH_HLEN or less, or when skbs were allocated before dynamic device/headroom changes. This could cause skb_under_panic() due to buffer underrun. The patch introduced usage of skb_cow_head() when VLAN_FLAG_REORDER_HDR is not set to ensure sufficient headroom for VLAN and device headers. It also uses READ_ONCE() to safely read dev->hard_header_len and dev->needed_headroom, preventing concurrency issues during lockless transmit path execution. Additionally, it avoids LL_RESERVED_SPACE(dev) to prevent unnecessary reallocations on inner stacked VLAN devices after pushing the outer VLAN header.

The vulnerability could cause kernel panics (skb_under_panic()) due to insufficient buffer headroom during VLAN packet processing, potentially affecting system stability and reliability. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update instructions.