{"id":24437,"date":"2026-09-16T20:32:19","date_gmt":"2026-09-16T12:32:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89780"},"modified":"2026-09-16T20:32:19","modified_gmt":"2026-09-16T12:32:19","slug":"cve-2026-89780","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89780","title":{"rendered":"CVE-2026-89780 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: qualcomm: rmnet: restore skb-&gt;dev on deaggregated frames<\/p>\n<p>rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and<br \/>\nleaves skb-&gt;dev NULL. __rmnet_map_ingress_handler() assigns<br \/>\nskb-&gt;dev = ep-&gt;egress_dev only on the data path, but a MAP command frame<br \/>\nis dispatched to rmnet_map_command() before that, so rmnet_map_send_ack()<br \/>\nruns netif_tx_lock(skb-&gt;dev) on a NULL device. An unprivileged user<br \/>\nreaches this by unsharing a user+net namespace, creating an rmnet link<br \/>\nover a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS,<br \/>\nand writing an aggregated frame carrying a flow-control command to the<br \/>\ntap fd.<\/p>\n<p>Restore the assignment dropped by 378e25357ac7, so every skb leaving<br \/>\nrmnet_map_deaggregate() has a valid device.<\/p>\n<p>  BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel\/locking\/spinlock.c:158)<br \/>\n  Write of size 4 at addr 00000000000004b4 by task exploit\/144<br \/>\n  Call Trace:<br \/>\n   _raw_spin_lock (kernel\/locking\/spinlock.c:158)<br \/>\n   netif_tx_lock (net\/sched\/sch_generic.c:497)<br \/>\n   rmnet_map_command (drivers\/net\/ethernet\/qualcomm\/rmnet\/rmnet_map_command.c:67)<br \/>\n   rmnet_rx_handler (drivers\/net\/ethernet\/qualcomm\/rmnet\/rmnet_handlers.c:125)<br \/>\n   __netif_receive_skb_core.constprop.0 (net\/core\/dev.c:6103)<br \/>\n   &#8230;<br \/>\n   __netif_receive_skb_one_core (net\/core\/dev.c:6214)<br \/>\n   netif_receive_skb (net\/core\/dev.c:6474)<br \/>\n   tun_get_user (drivers\/net\/tun.c:1966)<br \/>\n   tun_chr_write_iter (drivers\/net\/tun.c:2012)<br \/>\n   vfs_write (fs\/read_write.c:687)<br \/>\n   ksys_write (fs\/read_write.c:739)<br \/>\n   do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)<br \/>\n   entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<br \/>\n  Kernel panic &#8211; not syncing: Fatal exception in interrupt<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: qualcomm: rmnet: restore skb-&gt;dev on deaggregated frames<\/p>\n<p>rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() an<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24437","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}