Threats tagged 'ghsa-28qx-7jq4-9v6v'

CVE-2026-90083 is a Linux kernel vulnerability in the net/sched act_ife module that mishandles non-Ethernet frames. The flaw arises because act_ife assumes skb->dev->hard_header_len corresponds to the Ethernet header length, which is incorrect for non-Ethernet devices like PPP. This can cause skb_under_panic kernel crashes when headroom is tight. The patch restricts act_ife to operate only on Ethernet frames and drops packets without Ethernet headers to prevent out-of-bounds memory operations and kernel panics.