CVE-2026-98375

In the Linux kernel, the following vulnerability has been resolved:

xen/netfront: drop RX packets with a short Ethernet header

handle_incoming_queue() pulls pull_to bytes into the head before

calling eth_type_trans(). pull_to is the length of the first RX slot,

capped at RX_COPY_THRESHOLD, and that length comes from the backend.

Nothing checks it against ETH_HLEN.

If the first slot is shorter than ETH_HLEN and more slots follow, the

head ends up shorter than an Ethernet header while skb->len is longer,

and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is

shorter than ETH_HLEN, eth_type_trans() reads the header past the end

of the data instead.

Pull at least ETH_HLEN, and drop the packet if that fails, which also

drops packets too short to hold an Ethernet header. This also checks

the return value of the pull, which was ignored.