CVE-2026-98377

A flaw was found in the Linux kernel's VLAN (Virtual Local Area Network) networking component. A local user can exploit this vulnerability by transmitting crafted, undersized network frames that trigger multiple VLAN tag insertions without verifying the presence of a Media Access Control (MAC) header. As a result, uninitialized kernel memory is appended to the packet and sent over the network, leading to information disclosure.

A kernel information disclosure occurs because __vlan_insert_inner_tag() can rewrite an ETH_HLEN MAC header without first ensuring that mac_len bytes are present in the skb. With an IFF_TUN device whose hard_header_len is zero, a local process can submit a one byte AF_PACKET SOCK_RAW frame and apply additional VLAN push operations. The helper then moves bytes located beyond skb tail into the transmitted frame, exposing uninitialized slab data and potentially kernel address material. For the CVSS the PR:L value is used because triggering requires a local process with access to a raw packet socket and normally CAP_NET_RAW, while TUN or traffic control configuration may also require delegated CAP_NET_ADMIN. The issue is not remotely triggered by received network traffic, although disclosed bytes can be transmitted onto the adjacent layer two network. Impact is a kernel confidentiality breach and possible KASLR weakening. No out of bounds write, kernel crash, or direct privilege escalation primitive is demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.