In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header… (CVE-2026-98375)

The vulnerability in the Linux kernel's xen/netfront driver occurs because the function handle_incoming_queue() pulls a number of bytes from the first RX slot based on backend-provided length without verifying it against the minimum Ethernet header length (ETH_HLEN). If the first slot is shorter than ETH_HLEN but the total packet length is longer, the kernel's eth_type_trans() function triggers a BUG() due to inconsistent skb length and header size. If the entire packet is shorter than ETH_HLEN, eth_type_trans() reads beyond the data boundary. The fix enforces pulling at least ETH_HLEN bytes and drops packets that fail this check, preventing the kernel bug.

This vulnerability can cause a kernel crash (BUG()) when processing malformed or crafted network packets with short Ethernet headers in the xen/netfront driver. This may lead to denial of service on affected systems running the vulnerable Linux kernel versions.

A fix is available that enforces pulling at least the minimum Ethernet header length from received packets and drops packets that are too short. Users should apply the official Linux kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.