{"id":"CVE-2026-99066","summary":"can: dev: init_can_skb(): restore skb header initialization","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: init_can_skb(): restore skb header initialization\n\nCommit 9f10374bb024 (\"can: remove private CAN skb headroom infrastructure\")\nremoved the skb_reset_mac_header()/skb_reset_network_header()/\nskb_reset_transport_header() calls from init_can_skb(). As a result, RX\nskbs from alloc_can_skb() and friends again carry mac_header = 0xFFFF.\nWhen such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length\ncalculation overflows and triggers skb_under_panic -\u003e kernel BUG -\u003e full\nmachine panic.\n\nThe same issue was originally reported in 2014 on linux-can and fixed by\ncommit 969439016d2c (\"can: add missing initialisations in CAN related\nskbuffs\"). packet_rcv_spkt() itself has never been hardened: only\npacket_rcv() and tpacket_rcv() gained dev_has_header() checks in\ncommit d549699048b4 (\"net/packet: fix packet receive on L3 devices\nwithout visible hard header\").","modified":"2026-10-25T02:47:29.010935070Z","published":"2026-10-23T12:23:09.516Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99066.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0a04c0cb8606ff88399489d03ef255afe90d0d5f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99066.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99066"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9f10374bb024593a611e6845847f0444841a231b"},{"fixed":"8078375dfd0baecd9f1b7b06bb2d6f88d7cb8632"},{"fixed":"0a04c0cb8606ff88399489d03ef255afe90d0d5f"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99066.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99066.json"}}],"schema_version":"1.9.2"}