{"apiVersion":"1.0","identifier":"CVE-2026-99211","description":"In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb-s network and MAC headers. Netlink producers may reserve headroom without resetting those headers, allowing a receiving socket-s filter to read data before the initialized message. For example, IWPM HELLO replies are allocated with dev_alloc_skb(), which reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can attach a classic socket filter and disclose this headroom through the length of the delivered reply. The resets in netlink_dump() do not help because IWPM sends a separately allocated skb through netlink_unicast(). Reset both headers before running the receiver-s filter in unicast and broadcast delivery, as is already done for dump skbs. This also covers other netlink producers that reserve headroom without changing their allocation or message-building code.","publishedAt":"2026-10-28T11:17:42","lastModifiedAt":"2026-10-30T13:21:53","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99211","cvssScore":null,"cvssVector":null,"epssProbability":0.00167,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99211","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99211","en":"https://www.redsauce.net/en/cves/CVE-2026-99211","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99211","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99211","de":"https://www.redsauce.net/de/cves/CVE-2026-99211","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99211","el":"https://www.redsauce.net/el/cves/CVE-2026-99211"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99211"}}