CVE-2026-90083
kernel: net/sched: act_ife: Only operate on Ethernet frames
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 13, 2026
Description
A flaw was found in the Linux kernel. The act_ife (Ingress/Egress Forwarding Engine) component, which is designed to operate exclusively with Ethernet network frames, can improperly handle non-Ethernet packets. If a non-Ethernet packet is redirected to an Ethernet device configured with act_ife, the kernel attempts to process the packet using incorrect length calculations. This can lead to a kernel panic, resulting in a Denial of Service (DoS) for the affected system.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-124 · Buffer Underwrite ('Buffer Underflow')