CVE-2026-89780net: qualcomm: rmnet: restore skb->dev on deaggregated frames
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 378e25357ac78ad02fbc98bec9b4e3baaa916c5c builds before 5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c builds before 9b78ab84ddf97c06a8567edb62b6c0fd582f9a62; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c builds before 9d18c6c6cd1666b2cb7915cad052e22abf520997; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c builds before 4bcef54e4a3355a62d9ad90729fe563435ec76c3; from 378e25357ac78ad02fbc98bec9b4e3baaa916c5c before b14c22c31d9e30f38ea1693ac06d318f32258f5d; 378e25357ac78ad02fbc98bec9b4e3baaa916c5c builds before 7abe769e72c792e5f9eb273813eb3ecd8389854c; from 378e25357ac78ad02fbc98bec9b4e3baaa916c5c before 200460a0793dc6af97d3b36d92ac245350ac26fc; from 378e25357ac78ad02fbc98bec9b4e3baaa916c5c before a66734a1c5e36525ea07e9f4547fddc51e916de3 | CNA record |
References
- https://git.kernel.org/stable/c/5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd
- https://git.kernel.org/stable/c/9b78ab84ddf97c06a8567edb62b6c0fd582f9a62
- https://git.kernel.org/stable/c/9d18c6c6cd1666b2cb7915cad052e22abf520997
- https://git.kernel.org/stable/c/4bcef54e4a3355a62d9ad90729fe563435ec76c3
- https://git.kernel.org/stable/c/b14c22c31d9e30f38ea1693ac06d318f32258f5d
- https://git.kernel.org/stable/c/7abe769e72c792e5f9eb273813eb3ecd8389854c
- https://git.kernel.org/stable/c/200460a0793dc6af97d3b36d92ac245350ac26fc
- https://git.kernel.org/stable/c/a66734a1c5e36525ea07e9f4547fddc51e916de3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.