CVE-2026-89780

CVE CVE-2026-89780EUVD EUVD-2026-80301Published 2026-09-16T08:48:19.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.1.188; 4.17; patch: 7.3-rc1; patch: 5.10.270; patch: 6.6.157; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <b14c22c31d9e30f38ea1693ac06d318f32258f5d; patch: 6.12.110; patch: 7.2.6; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <7abe769e72c792e5f9eb273813eb3ecd8389854c; patch: 6.18.52; patch: 0; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <4bcef54e4a3355a62d9ad90729fe563435ec76c3; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <200460a0793dc6af97d3b36d92ac245350ac26fc; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <9d18c6c6cd1666b2cb7915cad052e22abf520997; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <9b78ab84ddf97c06a8567edb62b6c0fd582f9a62; patch: 5.15.221; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c <a66734a1c5e36525ea07e9f4547fddc51e916de3

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.