CVE-2026-89780 - Vulnerability Details

- net: qualcomm: rmnet: restore skb->dev on deaggregated frames

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and
leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns
skb->dev = ep->egress_dev only on the data path, but a MAP command frame
is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack()
runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user
reaches this by unsharing a user+net namespace, creating an rmnet link
over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS,
and writing an aggregated frame carrying a flow-control command to the
tap fd.

Restore the assignment dropped by 378e25357ac7, so every skb leaving
rmnet_map_deaggregate() has a valid device.

BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)
Write of size 4 at addr 00000000000004b4 by task exploit/144
Call Trace:
_raw_spin_lock (kernel/locking/spinlock.c:158)
netif_tx_lock (net/sched/sch_generic.c:497)
rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6103)
...
__netif_receive_skb_one_core (net/core/dev.c:6214)
netif_receive_skb (net/core/dev.c:6474)
tun_get_user (drivers/net/tun.c:1966)
tun_chr_write_iter (drivers/net/tun.c:2012)
vfs_write (fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt

Published: 2026-09-16

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel rmnet driver had a bug where sub‑frames created by rmnet_map_deaggregate() lacked a device assignment. When a MAP command frame was processed, the code attempted to lock the device that was still NULL, causing a null‑pointer dereference that resulted in a fatal kernel panic. The fault consumes only four bytes and terminates the system, disrupting all network services. The fault is triggered by a specific driver path and only produces a denial of service, not code execution.

Affected Systems

Affected systems are Linux kernel installations that include the rmnet driver without the recent commit that restores skb->dev. The CVE description does not list specific kernel versions, so any kernel running before the fix may be vulnerable.

Risk and Exploitability

The CVSS score is not provided and the EPSS is unavailable; however the impact is severe because it causes a kernel crash. The exploit requires an unprivileged user to unshare a user and network namespace, set up an rmnet link over a TAP interface with the INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS options, and write an aggregated frame carrying a flow‑control command. This chain is feasible but requires local access to the system and specific kernel features, implying moderate effort and risk. The vulnerability is not listed in CISA’s KEV catalog, but if the system patches are delayed it remains a high‑risk denial‑of‑service vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 9b78ab84ddf97c06a8567edb62b6c0fd582f9a62
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 9d18c6c6cd1666b2cb7915cad052e22abf520997
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 4bcef54e4a3355a62d9ad90729fe563435ec76c3
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< b14c22c31d9e30f38ea1693ac06d318f32258f5d
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 7abe769e72c792e5f9eb273813eb3ecd8389854c
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< 200460a0793dc6af97d3b36d92ac245350ac26fc
`378e25357ac78ad02fbc98bec9b4e3baaa916c5c`	affected	< a66734a1c5e36525ea07e9f4547fddc51e916de3

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,9b78ab84ddf97c06a8567edb62b6c0fd582f9a62)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,9d18c6c6cd1666b2cb7915cad052e22abf520997)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,4bcef54e4a3355a62d9ad90729fe563435ec76c3)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,b14c22c31d9e30f38ea1693ac06d318f32258f5d)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,7abe769e72c792e5f9eb273813eb3ecd8389854c)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,200460a0793dc6af97d3b36d92ac245350ac26fc)`	affected	code_commit	—
`[378e25357ac78ad02fbc98bec9b4e3baaa916c5c,a66734a1c5e36525ea07e9f4547fddc51e916de3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	semver	—
`[0,4.17)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that includes commit 378e25357ac7, which restores skb->dev before transmission.
If patching is not immediately possible, avoid creating RMnet links over TAP devices with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS until a fix is applied.
Enable kernel logging for KASAN or null‑pointer dereference events and monitor logs for suspicious activity, then consider restricting unshare of user+net namespaces for unprivileged users.

Generated by OpenCVE AI on September 16, 2026 at 14:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/200460a0793dc6af97d3b36d92ac245350ac26fc
https://git.kernel.org/stable/c/4bcef54e4a3355a62d9ad90729fe563435ec76c3
https://git.kernel.org/stable/c/5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd
https://git.kernel.org/stable/c/7abe769e72c792e5f9eb273813eb3ecd8389854c
https://git.kernel.org/stable/c/9b78ab84ddf97c06a8567edb62b6c0fd582f9a62
https://git.kernel.org/stable/c/9d18c6c6cd1666b2cb7915cad052e22abf520997
https://git.kernel.org/stable/c/a66734a1c5e36525ea07e9f4547fddc51e916de3
https://git.kernel.org/stable/c/b14c22c31d9e30f38ea1693ac06d318f32258f5d

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd. Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device. BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158) Write of size 4 at addr 00000000000004b4 by task exploit/144 Call Trace: _raw_spin_lock (kernel/locking/spinlock.c:158) netif_tx_lock (net/sched/sch_generic.c:497) rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103) ... __netif_receive_skb_one_core (net/core/dev.c:6214) netif_receive_skb (net/core/dev.c:6474) tun_get_user (drivers/net/tun.c:1966) tun_chr_write_iter (drivers/net/tun.c:2012) vfs_write (fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Title		net: qualcomm: rmnet: restore skb->dev on deaggregated frames
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/200460a0793dc6af97d3b36d92ac245350ac26fc https://git.kernel.org/stable/c/4bcef54e4a3355a62d9ad90729fe563435ec76c3 https://git.kernel.org/stable/c/5aaa7409c1b4ca4c60d66e2afa99703bf4eb7ddd https://git.kernel.org/stable/c/7abe769e72c792e5f9eb273813eb3ecd8389854c https://git.kernel.org/stable/c/9b78ab84ddf97c06a8567edb62b6c0fd582f9a62 https://git.kernel.org/stable/c/9d18c6c6cd1666b2cb7915cad052e22abf520997 https://git.kernel.org/stable/c/a66734a1c5e36525ea07e9f4547fddc51e916de3 https://git.kernel.org/stable/c/b14c22c31d9e30f38ea1693ac06d318f32258f5d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:19.760Z

Updated: 2026-09-16T08:48:19.760Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89780

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.520

Modified: 2026-09-16T09:17:08.520

Link: CVE-2026-89780

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T14:30:10Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object