CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved:

ppp_synctty: ensure a writeable skb header

ppp_sync_txmunge() checks headroom before prepending the address and

control bytes, but does not ensure that the skb header is writable.

A received skb can reach this function through PPP channel bridging

without passing through ppp_start_xmit(), which calls skb_cow_head().

For example, a PPPoE frame may share its buffer with a clone queued to

an AF_PACKET socket. If it is bridged to a synchronous tty channel, the

address/control bytes can overwrite data still visible to that socket.

Use skb_cow_head() to ensure both sufficient headroom and a writable

header.