---
id: CVE-2026-98526
title: 'llc: reserve device headroom for allocated frames'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  llc: reserve device headroom for allocated frames

  llc_alloc_frame() reserves link-layer headroom using the device type.
  This is insufficient for stacked Ethernet devic…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    018020f5a48cc86fdd6dc2d380f6c70443ae7639
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    7c38524b2b2456bd33cb360420da6cbf9cad1b33
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    1937222c2511ac91377d39f28106c34734f5f8c6
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    16ceac2daa89dd16917bc488ab05b9dd6961a603
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    e06f8b6e27cc616d3c587e9784c4a033eb310a16
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    3361c93e417384ebf28003e0fb6d5304653d3b05
  - >-
    Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a <
    72b5b9a28b996e09b8b5b944370c79851bb68f52
  - Linux 2.6.34
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:17:44.018Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98526'
references:
  - url: 'https://git.kernel.org/stable/c/018020f5a48cc86fdd6dc2d380f6c70443ae7639'
  - url: 'https://git.kernel.org/stable/c/3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1'
  - url: 'https://git.kernel.org/stable/c/7c38524b2b2456bd33cb360420da6cbf9cad1b33'
  - url: 'https://git.kernel.org/stable/c/1937222c2511ac91377d39f28106c34734f5f8c6'
  - url: 'https://git.kernel.org/stable/c/16ceac2daa89dd16917bc488ab05b9dd6961a603'
  - url: 'https://git.kernel.org/stable/c/e06f8b6e27cc616d3c587e9784c4a033eb310a16'
  - url: 'https://git.kernel.org/stable/c/3361c93e417384ebf28003e0fb6d5304653d3b05'
  - url: 'https://git.kernel.org/stable/c/72b5b9a28b996e09b8b5b944370c79851bb68f52'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.280Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

llc: reserve device headroom for allocated frames

llc_alloc_frame() reserves link-layer headroom using the device type.
This is insufficient for stacked Ethernet devices such as VLAN devices,
where vlan_dev_hard_header() pushes a VLAN header before the lower
device's Ethernet header. An LLC response on such a device can
therefore underflow skb headroom in eth_header().

Use LL_RESERVED_SPACE() to account for the device's actual required
headroom while preserving the existing LLC device-type check.

## Affected

- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 018020f5a48cc86fdd6dc2d380f6c70443ae7639`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 3a3f57c4061d9e9cc3bc04205d36ce41ae3406c1`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 7c38524b2b2456bd33cb360420da6cbf9cad1b33`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 1937222c2511ac91377d39f28106c34734f5f8c6`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 16ceac2daa89dd16917bc488ab05b9dd6961a603`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < e06f8b6e27cc616d3c587e9784c4a033eb310a16`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 3361c93e417384ebf28003e0fb6d5304653d3b05`
- `Linux >= bf9ae5386bca8836c16e69ab8fdbe46767d7452a < 72b5b9a28b996e09b8b5b944370c79851bb68f52`
- `Linux 2.6.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.