CVE-2026-98377

Executive Summary

CVE-2026-98377 is a Linux kernel vulnerability in the VLAN insertion path (__vlan_insert_inner_tag() and its ETH_HLEN wrappers) that permits an out-of-bounds read of uninitialised slab memory when a malformed, short AF_PACKET/SOCK_RAW frame is processed on an IFF_TUN device and VLAN tags are pushed. The flaw is reachable through local/unprivileged packet-socket operations combined with subsequent VLAN push actions (e.g., clsact action vlan push, bpf_skb_vlan_push()), resulting in kernel memory disclosure into transmitted frames. The primary impact is information disclosure (kernel slab memory leak, potentially containing pointer or address data), with adjacent risks of memory corruption due to unchecked buffer rewriting.

Technical Analysis

The vulnerability resides in the kernel's VLAN tag insertion helpers. The core function __vlan_insert_inner_tag() only guarantees write headroom via skb_cow_head(), but never guarantees that mac_len bytes of MAC header are actually present in the linear data area. Its ETH_HLEN-based wrappers — specifically __vlan_insert_tag() (reached via skb_vlan_push()) and vlan_insert_tag() (reached via validate_xmit_vlan() on the generic transmit path) — therefore rewrite the first 16 bytes at skb->data: a 12-byte memmove followed by two 2-byte stores at offsets +12 and +14.

No caller of these helpers supplies a length bound. By contrast, the corresponding pop helpers correctly use skb_ensure_writable()/pskb_may_pull() to validate data presence before manipulation. This asymmetry is the root cause.

The attack surface is opened by an IFF_TUN device, which has hard_header_len == 0. This allows packet_snd() to accept a one-byte AF_PACKET/SOCK_RAW frame. The first VLAN push merely sets a hardware-accelerator tag, but the next push — triggered by a clsact action vlan push or by bpf_skb_vlan_push() — enters the vulnerable helper with skb->len still equal to 1. Because the head buffer originates from skbuff_small_head without __GFP_ZERO, each VLAN push operation drags bytes from beyond skb->tail into the frame. After three pushes, the one-byte send is transmitted as 13 bytes, 11 of which are uninitialised slab memory.

The NVD description includes a concrete illustration: the emitted bytes 5a b3 62 12 80 88 ff ff 00 b3 62 12 81 show that only the original 0x5a was sent; the remainder is slab contents, in this example the top 56 bits of a linear-map kernel address. This demonstrates a kernel address disclosure primitive.

The fix concept, per the description, is to require that the MAC header the helper rewrites is actually present, so that such an undersized frame is dropped rather than transmitted. No public patch commit, release version, or backport identifier is available in the supplied data.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-98377. The attack chain below is inferred strictly from the mechanism described in the NVD entry and the vulnerability class (out-of-bounds read / insufficient input validation in kernel packet handling).

1. Reconnaissance / Target Identification — An adversary with the ability to open AF_PACKET/SOCK_RAW sockets (typically requiring CAP_NET_RAW, common in container and unprivileged user-namespace contexts where such capabilities are granted) identifies a target host with a Tun/Tap (IFF_TUN) interface and the ability to invoke VLAN push operations. No remote network exposure is described; the primitive is local to the kernel network stack.

2. Triggering the Flaw — Using packet_snd(), the attacker sends a one-byte AF_PACKET/SOCK_RAW frame on the IFF_TUN device (whose hard_header_len == 0). The frame is crafted to pass the initial validation but remain undersized relative to ETH_HLEN/mac_len.

3. Payload / Execution at the Vulnerability-Class Level — VLAN tags are pushed repeatedly (first push sets a hardware-accel tag; subsequent pushes enter __vlan_insert_inner_tag() via skb_vlan_push() / bpf_skb_vlan_push() or the validate_xmit_vlan() path). With skb->len still 1, the helper's 12-byte memmove and two 2-byte stores operate using bytes pulled from beyond skb->tail, since the small-head buffer is not zero-initialised. The result is a transmitted frame carrying uninitialised slab bytes.

4. Post-Exploitation Impact — The disclosed bytes may include kernel-pointer-derived data (the NVD example exposes the top 56 bits of a linear-map address). This leak can defeat kernel ASLR/KASLR and provide primitives useful for chaining a full kernel memory-corruption exploit; the same unchecked rewrite carries latent memory-corruption risk beyond mere disclosure.

Impact Assessment

The CVE has no NVD-assigned CVSS score or vector, so severity must be assessed qualitatively. The impact is primarily confidentiality: leakage of uninitialised kernel slab memory (demonstrably including kernel address material) into network frames. This is a classic KASLR-bypass / information-disclosure primitive that lowers the bar for subsequent kernel exploitation on the same host.

Systems most at risk are Linux hosts that (a) expose Tun/Tap interfaces and (b) permit AF_PACKET/SOCK_RAW usage by lower-privileged contexts — notably multi-tenant hosts, container platforms with permissive capability grants, and systems running untrusted local workloads. There is no described remote attack vector, so blast radius is host-local. Integrity/availability impact is conditioned on an attacker being able to leverage the rewritten buffer for corruption; the NVD text frames the concrete demonstrated effect as an out-of-bounds read.

Detection Guidance

Sigma Rule

title: Linux Kernel Short IFF_TUN Frame with Repeated VLAN Push (CVE-2026-98377)
id: 0d1b2a3c-4e5f-4a6b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects AF_PACKET/SOCK_RAW one-byte frames on IFF_TUN interfaces combined with repeated VLAN push operations, consistent with CVE-2026-98377 exploitation.
logsource:
  product: linux
  service: kernel
  category: process_creation
detection:
  selection_prog:
    Image|endswith:
      - '/bpf'
      - '/tc'
      - '/ip'
      - '/python3'
  selection_args:
    CommandLine|contains:
      - 'vlan push'
      - 'bpf_skb_vlan_push'
      - 'clsact'
  condition: selection_prog and selection_args
falsepositives:
  - Legitimate network configuration management
  - Container networking setup scripts
level: medium
tags:
  - attack.t1068
  - cve.2026.98377

YARA Rule

rule CVE_2026_98377_VLAN_Short_Frame_Leak
{
    meta:
        description = "Detects crafted AF_PACKET short frames / VLAN push artifacts associated with CVE-2026-98377"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-98377"
        severity = "medium"

    strings:
        $vlan_push = "vlan push" ascii nocase
        $bpf_push  = "bpf_skb_vlan_push" ascii
        $clsact    = "clsact" ascii

    condition:
        uint16(0) != 0x5A4D and
        filesize < 10MB and
        (any of ($vlan_push, $bpf_push, $clsact))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98377 Linux VLAN inner-tag push out-of-bounds read (short IFF_TUN frame)"; flow:to_server; dsize:<10; content:"|5a b3|"; depth:2; classtype:attempted-recon; sid:202698377; rev:1; metadata:cve CVE-2026-98377;)

Elastic Detection

process where host.os.type == "linux" and event.type == "start"
  and process.name in ("tc", "bpf", "ip")
  and process.args : ("vlan push", "bpf_skb_vlan_push", "clsact")

Splunk SPL Query

index=os sourcetype=linux_audit (comm="tc" OR comm="bpf" OR comm="ip")
| search (proctitle="*vlan push*" OR proctitle="*bpf_skb_vlan_push*" OR proctitle="*clsact*")
| stats count min(_time) as firstTime max(_time) as lastTime by host, comm, proctitle
| where count > 0

Wazuh OSSEC Rule

<group name="linux,cve-2026-98377,">
  <rule id="983770" level="8">
    <decoded_as>json</decoded_as>
    <field name="command">vlan push|bpf_skb_vlan_push|clsact</field>
    <description>CVE-2026-98377: possible kernel VLAN push short-frame memory leak configuration on $(hostname)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

   • Restrict AF_PACKET/SOCK_RAW access (CAP_NET_RAW): remove it from unprivileged user namespaces and container profiles where not strictly required.
   • Disable or tightly control clsact/tc and BPF skb_vlan_push usage on hosts exposing Tun/Tap interfaces.
   • Minimise IFF_TUN interfaces and avoid mixed trusted/untrusted local workloads on the same kernel.
   • Add the Suricata/Wazuh detections above to flag the anomalous short-frame + VLAN push pattern.

2. Patch / Upgrade Steps

   • No stable backport, commit hash, or release version is available in the supplied data. Monitor the upstream Linux kernel netdev tree and your distribution's security advisories for the fix that enforces MAC-header presence in __vlan_insert_inner_tag().
   • Apply the vendor kernel update as soon as it is published; validate with your normal kernel regression testing.

3. Long-Term Hardening

   • Maintain least-privilege capability grants; audit user-namespace configurations.
   • Enable kernel heap hardening (CONFIG_INIT_ON_ALLOC_DEFAULT_ON / CONFIG_INIT_STACK_ALL_ZERO) to reduce uninitialised-memory leakage impact.
   • Keep kernel and BPF subsystem current; track netdev security fixes via distro advisories.

References

• NVD — CVE-2026-98377: https://nvd.nist.gov/vuln/detail/CVE-2026-98377
• Linux kernel network (netdev) subsystem patch discussion for __vlan_insert_inner_tag() (monitor upstream; no commit ID available in supplied data)
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html

No public proof-of-concept, exploit-in-the-wild evidence, or named threat-actor campaign related to CVE-2026-98377 was identified in the provided data. CISA KEV status: not listed.