{"id":25569,"date":"2026-09-18T04:31:34","date_gmt":"2026-09-17T20:31:34","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90160"},"modified":"2026-09-18T04:31:34","modified_gmt":"2026-09-17T20:31:34","slug":"cve-2026-90160","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90160","title":{"rendered":"CVE-2026-90160 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nlwt_bpf: Restore rese"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>lwt_bpf: Restore reserved headroom after xmit program<\/p>\n<p>ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT<br \/>\nxmit. An LWT_XMIT BPF program can then modify the skb head and still<br \/>\nreturn BPF_OK, so bpf_xmit() rechecks the remaining headroom before the<br \/>\nskb continues to neighbour output.<\/p>\n<p>That recheck uses dst-&gt;dev-&gt;hard_header_len. This is not enough for the<br \/>\nneighbour cached-header path: neigh_hh_output() copies the cached hardware<br \/>\nheader using the aligned hh_cache size, HH_DATA_MOD for short headers or<br \/>\nHH_DATA_ALIGN(hh_len) otherwise.<\/p>\n<p>On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If<br \/>\nan LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can<br \/>\nstill have 15 bytes of headroom after the program. The existing check<br \/>\naccepts that, after which neigh_hh_output() hits its headroom warning and<br \/>\ndrops the skb.<\/p>\n<p>Use LL_RESERVED_SPACE(dst-&gt;dev) in the post-BPF headroom check to match<br \/>\nthe reservation made before LWT xmit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>lwt_bpf: Restore reserved headroom after xmit program<\/p>\n<p>ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT<br \/>\nxmit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25569","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}