CVE-2026-97964 ppp_synctty: ensure a writeable skb header
A missing writable header check in the Linux kernel PPP sync tty driver allows remote attackers to corrupt shared memory buffers via crafted PPPoE frames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97964?
CVE-2026-97964 is a memory corruption vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ppp_synctty: ensure a writeable skb header
ppp_sync_txmunge() checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP channel bridging without passing through ppp_start_xmit(), which calls skb_cow_head().
For example, a PPPoE frame may share its buffer with a clone queued to an AF_PACKET socket. If it is bridged to a synchronous tty channel, the address/control bytes can overwrite data still visible to that socket.
Use skb_cow_head() to ensure both sufficient headroom and a writable header.
Which versions are affected by CVE-2026-97964?
How do I fix CVE-2026-97964?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-97964 being exploited?
There is no known exploitation of CVE-2026-97964 in the wild and no public exploit code.
Sources
Also known as AZL-104238, BELL-CVE-2026-97964, DEBIAN-CVE-2026-97964, GHSA-59xx-49mr-rmvq, UBUNTU-CVE-2026-97964.