CVE-2026-99211

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netlink: reset skb headers before unicast and multicast filtering<br /> <br /> Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to<br /> an skb&amp;#39;s network and MAC headers. Netlink producers may reserve<br /> headroom without resetting those headers, allowing a receiving socket&amp;#39;s<br /> filter to read data before the initialized message.<br /> <br /> For example, IWPM HELLO replies are allocated with dev_alloc_skb(),<br /> which reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can<br /> attach a classic socket filter and disclose this headroom through the<br /> length of the delivered reply. The resets in netlink_dump() do not help<br /> because IWPM sends a separately allocated skb through netlink_unicast().<br /> <br /> Reset both headers before running the receiver&amp;#39;s filter in unicast and<br /> broadcast delivery, as is already done for dump skbs. This also covers<br /> other netlink producers that reserve headroom without changing their<br /> allocation or message-building code.