CVE-2026-97964

A flaw was found in the Linux kernel's Point-to-Point Protocol (PPP) synchronous tty driver. When network packets are forwarded through PPP channel bridging, the driver prepends protocol header bytes to shared packet buffers without ensuring they are exclusively writable. This issue allows network traffic or a local user to overwrite data in shared network buffers, leading to data corruption or a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's Point-to-Point Protocol (PPP) synchronous tty driver (ppp_synctty). The ppp_sync_txmunge() function checks that a received socket buffer (skb) has sufficient headroom before prepending the PPP address and control bytes, but it does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which would normally call skb_cow_head(). As a result, when a packet buffer is shared, for example a PPPoE frame whose clone is queued to an AF_PACKET socket, prepending the address and control bytes can overwrite data still visible to that socket. This allows network traffic or a local user to corrupt shared network packet buffers, leading to data corruption or a denial of service. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting an availability-only impact that requires local access with low privileges.

Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle Operating System (RHIVOS) 2, and OpenShift 4 and OpenShift 5 are affected; the fix is deferred for these releases and will be delivered in a future kernel update. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those kernels. The residual risk of the deferred fix is limited because exploitation requires the non-default configuration of PPP channel bridging to a synchronous tty channel combined with a packet buffer shared with another consumer, such as a clone queued to an AF_PACKET socket, which is uncommon in typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.