CVE-2026-98375

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN. If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead. Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored.

• https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801
• https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067
• https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e
• http://www.openwall.com/lists/oss-security/2026/10/09/3
• http://xenbits.xen.org/xsa/advisory-522.html