SECURITY ANNOUNCEMENT

CVE-2026-99066

23 October 2026

The same issue was originally reported in 2014 on linux-can and fixed by skbuffs"). packet_rcv_spkt() itself has never been hardened: only packet_rcv() and tpacket_rcv() gained dev_has_header() checks in

Introduced

7.09f10374bb024593a611e6845847f0444841a231b

Fixed releases

7.2.118078375dfd0baecd9f1b7b06bb2d6f88d7cb8632

7.30a04c0cb8606ff88399489d03ef255afe90d0d5f

View source announcement ↗