{"id":34938,"date":"2026-10-09T16:32:30","date_gmt":"2026-10-09T08:32:30","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98375"},"modified":"2026-10-09T16:32:30","modified_gmt":"2026-10-09T08:32:30","slug":"cve-2026-98375","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98375","title":{"rendered":"CVE-2026-98375 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nxen\/netfront: drop RX"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xen\/netfront: drop RX packets with a short Ethernet header<\/p>\n<p>handle_incoming_queue() pulls pull_to bytes into the head before<br \/>\ncalling eth_type_trans().  pull_to is the length of the first RX slot,<br \/>\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.<br \/>\nNothing checks it against ETH_HLEN.<\/p>\n<p>If the first slot is shorter than ETH_HLEN and more slots follow, the<br \/>\nhead ends up shorter than an Ethernet header while skb-&gt;len is longer,<br \/>\nand eth_type_trans() BUG()s in __skb_pull().  If the whole packet is<br \/>\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end<br \/>\nof the data instead.<\/p>\n<p>Pull at least ETH_HLEN, and drop the packet if that fails, which also<br \/>\ndrops packets too short to hold an Ethernet header.  This also checks<br \/>\nthe return value of the pull, which was ignored.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xen\/netfront: drop RX packets with a short Ethernet header<\/p>\n<p>handle_incoming_queue() pulls pull_to bytes into the head before<br \/>\ncallin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34938","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}