CVE-2026-90160
lwt_bpf: Restore reserved headroom after xmit program
Description
In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT xmit. An LWT_XMIT BPF program can then modify the skb head and still return BPF_OK, so bpf_xmit() rechecks the remaining headroom before the skb continues to neighbour output. That recheck uses dst->dev->hard_header_len. This is not enough for the neighbour cached-header path: neigh_hh_output() copies the cached hardware header using the aligned hh_cache size, HH_DATA_MOD for short headers or HH_DATA_ALIGN(hh_len) otherwise. On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If an LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can still have 15 bytes of headroom after the program. The existing check accepts that, after which neigh_hh_output() hits its headroom warning and drops the skb. Use LL_RESERVED_SPACE(dst->dev) in the post-BPF headroom check to match the reservation made before LWT xmit.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 17, 2026, 5:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update Linux kernel to include the fix for lwt_bpf headroom issue.
- Verify headroom calculation in LWT xmit and neighbour output.
- Apply patch to correct headroom check in ip_finish_output2 function.
- Test network stack for stability after applying the fix.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90160.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90160 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90160
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90160 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90160 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT xmit. An LWT_XMIT BPF program can then modify the skb head and still return BPF_OK, so bpf_xmit() rechecks the remaining headroom before the skb continues to neighbour output. That recheck uses dst->dev->hard_header_len. This is not enough for the neighbour cached-header path: neigh_hh_output() copies the cached hardware header using the aligned hh_cache size, HH_DATA_MOD for short headers or HH_DATA_ALIGN(hh_len) otherwise. On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If an LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can still have 15 bytes of headroom after the program. The existing check accepts that, after which neigh_hh_output() hits its headroom warning and drops the skb. Use LL_RESERVED_SPACE(dst->dev) in the post-BPF headroom check to match the reservation made before LWT xmit. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90160.json">CVE-2026-90160</a> Added Reference https://git.kernel.org/stable/c/179a5b2171573d94a25c9aa8e1c9f9ac352ad316 Added Reference https://git.kernel.org/stable/c/5fe7007aed9ad069b2bd77e5d0c875c64f5c0269 Added Reference https://git.kernel.org/stable/c/753e5cdcca5474d230d62bb3489e5168ab27c272 Added Reference https://git.kernel.org/stable/c/7cf561843ed0ad57501892a65abb77957e6c800f Added Reference https://git.kernel.org/stable/c/7d043e24520a273c362be5dd7d9c82796879a49b Added Reference https://git.kernel.org/stable/c/a38c0eb447e2dd0120a2ebcdba470f9505ac8907 Added Reference https://git.kernel.org/stable/c/c488071c3441fa34f5a87cd6c12ce2cc6304f20e Added Reference https://git.kernel.org/stable/c/de2b2004e16f2930eb689175e2c1998b0a68d499