CVE-2026-90083: net/sched: act_ife: Only operate on Ethernet frames
Noroxi assessment
Priority: Monitor (action score 0/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.21% (FIRST EPSS).
- Fixed version: Linux Linux 138b0054021fd7d57bc3eb68b3f4e2bcec037849, 13dddf87a1f89557920f9b437a21ea0b7225f828, 3c07621770b04f19b67e3af4a24b4d447826fbdd; azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 Release Notes; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Release Notes.
Low priority for now. Upgrade to Linux Linux 138b0054021fd7d57bc3eb68b3f4e2bcec037849, 13dddf87a1f89557920f9b437a21ea0b7225f828, 3c07621770b04f19b67e3af4a24b4d447826fbdd; azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 Release Notes; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Release Notes or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Only operate on Ethernet frames act_ife encapsulates/decapsulates the original Ethernet header and uses skb->dev->hard_header_len as the length of that header. That is only correct for Ethernet devices: on a device where hard_header_len does not match the L2 header that was actually pulled (PPP reports PPP_HDRLEN while nothing is stripped on ingress), the ingress skb_push()/skb_pull() use the wrong length and can hit skb_under_panic when headroom is tight. IFE is Ethernet-only by design - it builds an outer ethhdr, rewrites h_source/h_dest/h_proto, and calls eth_type_trans() on decode - so instead of trying to make the offsets work for arbitrary link types, simply drop packets that do not carry an Ethernet header. Checking skb->dev->type alone is not enough. We have to cater for a corner case where mirred can redirect an skb from a non-Ethernet device to an Ethernet one, and skb->dev then says nothing about the framing the skb actually has: an skb redirected from ppp0 reaches the target's ingress hook with mac_len 0 and no Ethernet header at all. So at ingress also require mac_len to be ETH_HLEN. On egress mac_len is not maintained, so the device type is all we have; a bogus redirect there yields a malformed frame rather than an out-of-bounds push, and it would be malformed with or without IFE. That corner case is not theoretical - redirecting from ppp0 into a veth that has an ife encode action on its ingress hook panics without this patch: skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000 data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3 kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657) tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874) tc_run (net/core/dev.c:4463) netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522) tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328) tcf_mirred_act (net/sched/act_mirred.c:489) tc_run (net/core/dev.c:4463) process_backlog (net/core/dev.c:6728) With Ethernet framing guaranteed, use ETH_HLEN instead of hard_header_len.
- Published
- Sep 17, 2026
- Updated
- Oct 30, 2026
- EPSS
- 0.2% · 11th percentile
- CWE
- —
Report tools
Action score
0
Monitor
Low priority for now.
- CVSS
- 0 / 40 · —
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Running WordPress? Scan your site free with WP Lens
Noroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
—
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 4.11affected
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before 3c07621770b04f19b67e3af4a24b4d447826fbddaffected · git
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before b951dd2fd5ede007474fc134ecb5639e1f86f5deaffected · git
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before 13dddf87a1f89557920f9b437a21ea0b7225f828affected · git
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before d218ea7df6eba076171f2d4897a429a31f2139f0affected · git
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before 138b0054021fd7d57bc3eb68b3f4e2bcec037849affected · git
- 295a6e06d21e1f469c9f38b00125a13b60ad4e7c and later · before 5b483f7791b079bb97d411f1066652ff659207ffaffected · git
- before 4.11not affected · semver
- 6.1.191 and later · up to and including 6.1.*not affected · semver
- 6.6.160 and later · up to and including 6.6.*not affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | from 0 | — |
| Debian:14 | linux | before 7.2.6-1 | 7.2.6-1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation40Plan
- CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment40Plan
- CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()40Plan
Published before and after this one in the same product
- ← EarlierCVE-2026-90081Sep 17, 2026 · net/rds: use wq_has_sleeper() in rds_cong_map_updated()0Monitor
- ← EarlierCVE-2026-90082Sep 17, 2026 · net: mana: Cap MSI-X vectors to the device MSI-X table size0Monitor
- Later →CVE-2026-90084Sep 17, 2026 · octeontx2-vf: fix workqueue and netdev race in probe/remove0Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 138b0054021fd7d57bc3eb68b3f4e2bcec037849 | Vendor (CNA) |
| Linux Linux | 13dddf87a1f89557920f9b437a21ea0b7225f828 | Vendor (CNA) |
| Linux Linux | 3c07621770b04f19b67e3af4a24b4d447826fbdd | Vendor (CNA) |
| Linux Linux | 5b483f7791b079bb97d411f1066652ff659207ff | Vendor (CNA) |
| Linux Linux | b951dd2fd5ede007474fc134ecb5639e1f86f5de | Vendor (CNA) |
| Linux Linux | d218ea7df6eba076171f2d4897a429a31f2139f0 | Vendor (CNA) |
| azl3 kernel 6.6.150.1-1 on Azure Linux 3.0 | — | Microsoft (MSRC) |
| azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 | Release Notes | Microsoft (MSRC) |
| azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 | Release Notes | Microsoft (MSRC) |
| debian:linux | 7.2.6-1 · Debian:14 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
No CVSS vector for this record, so attack conditions can't be derived.
Weakness class (CWE)
—
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (5 more)Show less
- git.kernel.org/stable/c/13dddf87a1f89557920f9b437a21ea0b7225f828
- git.kernel.org/stable/c/3c07621770b04f19b67e3af4a24b4d447826fbdd
- git.kernel.org/stable/c/5b483f7791b079bb97d411f1066652ff659207ff
- git.kernel.org/stable/c/b951dd2fd5ede007474fc134ecb5639e1f86f5de
- git.kernel.org/stable/c/d218ea7df6eba076171f2d4897a429a31f2139f0
Vendor advisories and official records. Exploit/PoC links are deliberately left out.