CVE-2026-98375

Executive Summary

CVE-2026-98375 is a memory-safety vulnerability in the Linux kernel's xen/netfront paravirtualized network front-end driver. The flaw resides in handle_incoming_queue(), which fails to validate the length of the first receive slot against ETH_HLEN before pulling data into the socket buffer head and calling eth_type_trans(). A malicious or compromised Xen backend can deliver a short first RX slot, causing a kernel BUG() in __skb_pull() or an out-of-bounds read past the end of packet data. The primary impact is denial of service against the guest VM's networking stack; in the misaligned-header case, the kernel BUG halts the affected CPU context. Systems running Linux guests on Xen hypervisors with an untrusted or attacker-controlled backend (for example, a compromised driver domain or a hostile co-tenant in privileged networking configurations) are affected.

Technical Analysis

The Xen network architecture splits the NIC into two halves: a frontend driver (xen/netfront) running in the guest, and a backend driver (xen/netback) running in a driver domain, which may be a separate privileged VM (e.g., domain 0) or a disaggregated storage/networking domain. The two communicate over a shared ring buffer, with packet data passed through grant references or copied into the frontend's memory. Critically, the frontend trusts the backend with respect to packet framing metadata such as slot lengths and descriptor contents. This trust boundary is the root of the vulnerability class.

The vulnerable code path is handle_incoming_queue(). When processing receive slots, this function:

1. Determines pull_to — the number of bytes to be linearized into the skb head. This value is taken from the length of the first RX slot, capped at RX_COPY_THRESHOLD.
2. Pulls pull_to bytes into the head of the socket buffer.
3. Calls eth_type_trans() to classify the Ethernet protocol (and, as a side effect, trim the Ethernet header from the linear data).

The bug: the code never checks pull_to against ETH_HLEN (the size of an Ethernet header, 14 bytes). Two distinct failure conditions result:

• Case A — Mixed slot lengths. If the first slot is shorter than ETH_HLEN but additional slots follow, the linear head region ends up shorter than a full Ethernet header while skb->len (the logical total packet length) remains longer. When eth_type_trans() attempts to pull the Ethernet header, the internal __skb_pull() sanity check fires and triggers a BUG(). A BUG() in kernel context is a hard failure — it halts the current execution and can take down the guest.
• Case B — Entire packet shorter than ETH_HLEN. If the whole received packet is shorter than 14 bytes, there is no follow-on slot to mask the problem, and eth_type_trans() simply reads the Ethernet header past the end of the data, producing an out-of-bounds read.

The upstream fix pulls at least ETH_HLEN bytes into the head and drops the packet if that pull fails — which simultaneously:

• prevents the short-header condition from reaching eth_type_trans(), and
• rejects any packet too small to legitimately hold an Ethernet header, and
• (as an additional correctness fix) checks the return value of the pull, which was previously ignored.

This is a textbook improper input validation / trust-boundary violation (CWE-20) at a paravirtualized device boundary. The frontend driver validates the quantity of data available but not the minimum structurally required amount before invoking header-parsing logic.

Attack surface: the Xen virtual network receive path. The bug is triggerable by anything that controls or can influence the backend's view of RX slot lengths — most directly, a malicious or compromised backend domain, but also via any path that permits crafted ring descriptors (e.g., a disaggregated or multi-tenant Xen deployment where the networking backend is not fully trusted by the guest).

Note on scoring: No NVD-supplied CVSS, CWE, EPSS, or patch metadata was provided with this CVE record. The CVSS vector and CWE shown in METADATA are the analyst's assessment based strictly on the described mechanism (adjacent/co-resident attack vector, no privileges required, potential scope change due to hypervisor boundary, availability impact from kernel BUG). They are not vendor- or NVD-published values and should be treated as provisional.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class (unvalidated length from an untrusted backend reaching Ethernet header parsing) and strictly limited to mechanisms named in the description.

1. Reconnaissance / target identification. The adversary identifies a Xen deployment in which it can influence or control the network backend serving a target guest — for example, a compromised driver domain, a privileged VM handling guest networking, or a deployment scenario in which the networking backend is operated by a party that is not fully trusted by the guest. The attacker does not need code execution inside the victim guest.

2. Trigger of the flaw class. The attacker crafts RX traffic such that the first RX slot presented to the guest frontend is shorter than ETH_HLEN, leveraging the fact that slot length is backend-controlled. Two variants:

   • Deliver a first slot shorter than ETH_HLEN with additional slots following (head shorter than an Ethernet header while skb->len is larger) → eth_type_trans() → __skb_pull() → BUG().
   • Deliver a complete packet shorter than ETH_HLEN → out-of-bounds read of the Ethernet header.

   The trigger is at the packet/frame level via the shared RX ring; no application-layer payload is required.

3. Payload/execution method (vulnerability-class level). This is not a code-execution vulnerability in the classic sense. The "payload" is a malformed frame layout — specifically a short or undersized first RX slot — delivered through normal network receive pathing. The impact is realized directly at the kernel networking code path; there is no separate injection step.

4. Post-exploitation impact.

   • Denial of service: The BUG() in __skb_pull() halts the affected kernel execution context, taking the guest's networking (and potentially the guest) down — a remotely triggerable DoS from the backend.
   • Information disclosure (limited/theoretical): The out-of-bounds read in the whole-packet-shorter-than-ETH_HLEN case reads past the end of packet data. Any such disclosure would be of adjacent in-kernel memory to the classification logic, but the description provides no evidence of leakage to an attacker-controlled sink; this should be treated as a secondary/uncertain consequence, not a confirmed exfiltration primitive.

There is no described path to privilege escalation or arbitrary code execution in this record.

Impact Assessment

• Confidentiality: No reliable disclosure path is established. The out-of-bounds read exists, but the description offers no leak primitive — assessed as None/Low.
• Integrity: No data modification is described — assessed as None.
• Availability: The kernel BUG() halts execution; this is the core impact — assessed as High.
• Scope: The flaw crosses the frontend/backend trust boundary in a paravirtualized environment, so a change of scope is plausible (the attacker is adjacent to, not inside, the victim guest) — assessed as Changed.

Affected systems: Linux guests running on Xen hypervisors where the network backend is not fully trusted. Virtualized and cloud environments using Xen with untrusted driver domains, disaggregated networking, or hostile co-tenancy are the primary exposure. No specific kernel version range, distribution, or package list has been provided, so affected-version scoping could not be confirmed from the available data.

Blast radius: Per affected guest, the impact is loss of network service and potential guest instability from the kernel BUG. In multi-tenant or driver-domain architectures, a single compromised backend can neutralize the networking of many guests simultaneously, amplifying availability impact across the fleet.

Business impact: Network availability loss for virtualized workloads; potential cascading failures where the guest is a service or control-plane node; incident-response and failover costs. The lack of a confirmed patch or published advisory elevates the operational risk of relying on vendor timelines.

Detection Guidance

Detection for this CVE is challenging because the fault is inside the kernel's RX path and leaves no obvious application artifact. The rules below target anomalous malformed-frame handling and the observable symptoms of the DoS.

Sigma Rule

title: Xen netfront Short Ethernet Header RX Packet Handling
id: 7a9c4f21-0d3e-4b6a-9f1c-xen98375
status: experimental
description: Detects kernel log signatures consistent with the xen/netfront
  short-first-RX-slot defect (CVE-2026-98375) leading to BUG in __skb_pull / eth_type_trans.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98375
author: valtersit.com
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - '__skb_pull'
    - 'eth_type_trans'
    - 'netfront'
    - 'handle_incoming_queue'
    - 'kernel BUG at'
  condition: selection
  selection:
    - 'netfront' or 'eth_type_trans' or '__skb_pull'
falsepositives:
  - Legitimate kernel BUG reports unrelated to netfront
  - Other drivers invoking eth_type_trans
level: high
tags:
  - attack.t1190

YARA Rule

rule CVE_2026_98375_xen_netfront_short_eth_header
{
    meta:
        description = "Flags netfront receive-path source/build artifacts referencing the unfixed short-first-slot Ethernet header handling in handle_incoming_queue()"
        cve = "CVE-2026-98375"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98375"
        date = "2026-01-01"

    strings:
        $a = "handle_incoming_queue" ascii
        $b = "eth_type_trans" ascii
        $c = "RX_COPY_THRESHOLD" ascii
        $d = "__skb_pull" ascii
        $e = "netfront" ascii

    condition:
        uint32(0) != 0xfeedface and
        any of ($a, $b, $c, $d, $e)
}

Suricata IDS Rule

Because the crash occurs below the network layer, network detection targets undersized/truncated Ethernet frames delivered toward Xen guests. Rule is provided at the vulnerability-class level.

alert ether any any -> any any (msg:"CVE-2026-98375 Possible Xen netfront undersized Ethernet frame (short RX slot)"; \
  byte_test:0,<,14,0,relative; \
  threshold:type limit, track by_src, count 1, seconds 60; \
  classtype:attempted-dos; \
  sid:202698375; rev:1; \
  metadata:cve CVE-2026-98375, vendor Linux;)

Elastic Detection

sequence by host.id with maxspan=10s
  [kernel where process.name == null and
     message : (
        "*netfront*" or
        "*eth_type_trans*" or
        "*__skb_pull*" or
        "*handle_incoming_queue*"
     ) and event.category : "process"]
  [kernel where message : "*BUG*" or message : "*kernel BUG at*"]

Splunk SPL Query

index=os_linux (sourcetype=syslog OR sourcetype=kernel)
(message="*netfront*" OR message="*handle_incoming_queue*" OR message="*eth_type_trans*" OR message="*__skb_pull*" OR message="*kernel BUG at*")
| eval cve="CVE-2026-98375"
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as evidence by host, cve
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort -count

Wazuh OSSEC Rule

<group name="linux,xen,cve-2026-98375,">
  <rule id="100375" level="12">
    <decoded_as>syslog</decoded_as>
    <match>kernel BUG at|netfront|eth_type_trans|__skb_pull|handle_incoming_queue</match>
    <description>CVE-2026-98375: Xen netfront short-Ethernet-header RX path anomaly detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was returned from any tracked source, and no vendor fix, workaround, or affected version range was provided. The upstream Linux kernel commit that resolves this issue ("xen/netfront: drop RX packets with a short Ethernet header") is described in the CVE record as the fix, but no released version tag or downstream backport has been confirmed here. Operators must track their distribution's kernel security channel for the corresponding backport.

1) Immediate mitigations (until a kernel is available):

• Reduce the attack surface by not running untrusted or attacker-influenceable Xen network backends. Where possible, keep the driver domain fully trusted and isolated from less-trusted workloads.
• Harden the driver domain: apply least privilege, restrict cross-VM access, and monitor the backend for compromise — the backend is the exploitation precondition.
• Apply rate limiting / malformed-frame filtering at the boundary nearest the backend where feasible, as a defense-in-depth measure (detection above).
• Segment workloads so that compromise of one backend cannot reach many guests; avoid placing hostile co-tenants behind the same untrusted networking backend.

2) Patch/upgrade steps:

• Monitor the Linux kernel stable tree and your distribution's security advisories for a kernel that includes the "xen/netfront: drop RX packets with a short Ethernet header" fix.
• Once released, upgrade affected guests to the patched kernel and reboot to activate it (a kernel fix is not effective until the running kernel is replaced).
• Validate post-upgrade by confirming the netfront driver revision contains the ETH_HLEN minimum-pull check.

3) Long-term hardening:

• Treat paravirtualized device backends as an untrusted data source; ensure all frontend drivers validate length and structural invariants before parsing.
• Enable kernel hardening features (e.g., panic-on-oops controls, kernel self-protection, hardened allocators) to reduce the blast radius of kernel BUG() events, while noting that doing so can convert a guest crash into a host-level event — test carefully.
• Implement continuous integrity monitoring of driver and hypervisor components, and maintain an up-to-date patch cadence for both hypervisor and guest kernels.
• Include abnormal guest reboot/network-loss patterns in availability monitoring, since the primary symptom is a guest-side crash rather than an obvious exploit artifact.

References

• NVD — CVE-2026-98375: https://nvd.nist.gov/vuln/detail/CVE-2026-98375
• Linux kernel source (netfront driver) — drivers/net/xen-netfront.c: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/xen-netfront.c
• Linux kernel stable tree (fix backport tracking): https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CISA Known Exploited Vulnerabilities Catalog (not currently listed — verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor evidence: None. No public PoC, exploit code, Nuclei template, or CISA KEV listing was provided for CVE-2026-98375. No threat actor campaigns are associated with this CVE in the supplied data.