CVE-2026-98158

A flaw was found in the Linux kernel's Point-to-Point Protocol asynchronous (ppp_async) driver. When handling corrupted network frames, the driver improperly reuses packet buffers without preserving the required memory headroom. A connected peer can exploit this flaw by sending a sequence of crafted network frames, triggering an out-of-bounds memory read and a system crash, resulting in a Denial of Service (DoS).

A moderate denial-of-service vulnerability was found in the Linux kernel's Point-to-Point Protocol asynchronous (ppp_async) driver, affecting the Red Hat Enterprise Linux kernel and kernel-rt, Red Hat In-Vehicle OS, and OpenShift (RHEL CoreOS) kernels. On the frame-error path, ppp_async's process_input_packet() resets a reused socket buffer's headroom to zero instead of preserving the NET_SKB_PAD headroom that dev_alloc_skb() guarantees, so the next frame is reassembled into a buffer with no headroom at all. A peer on an established PPP asynchronous link can exploit this by sending a frame with a bad FCS followed by a crafted frame, which causes the two-byte PPP filter direction tag pushed in ppp_receive_nonmp_frame() to be written before the start of the buffer and triggers an skb_under_panic that crashes the kernel. When CCP compression is enabled, ppp_decompress_frame() can also read out of bounds before the start of the buffer for the same reason. The verified consequence is a system-wide denial of service; no confidentiality or integrity impact has been demonstrated. Red Hat rates the impact of this flaw as moderate because exploitation requires the ability to exchange traffic as a peer on a configured PPP asynchronous link on the affected system and because only availability is affected. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Given the moderate impact rating and the constrained exposure, fixes for the affected products are currently deferred; the residual risk is that an attacker able to act as a peer on an established PPP asynchronous link can crash an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.