CVE-2026-98158

A moderate denial-of-service vulnerability was found in the Linux kernel's Point-to-Point Protocol asynchronous (ppp_async) driver, affecting the Red Hat Enterprise Linux kernel and kernel-rt, Red Hat In-Vehicle OS, and OpenShift (RHEL CoreOS) kernels. On the frame-error path, ppp_async's process_input_packet() resets a reused socket buffer's headroom to zero instead of preserving the NET_SKB_PAD headroom that dev_alloc_skb() guarantees, so the next frame is reassembled into a buffer with no headroom at all. A peer on an established PPP asynchronous link can exploit this by sending a frame with a bad FCS followed by a crafted frame, which causes the two-byte PPP filter direction tag pushed in ppp_receive_nonmp_frame() to be written before the start of the buffer and triggers an skb_under_panic that crashes the kernel. When CCP compression is enabled, ppp_decompress_frame() can also read out of bounds before the start of the buffer for the same reason. The verified consequence is a system-wide denial of service; no confidentiality or integrity impact has been demonstrated. Red Hat rates the impact of this flaw as moderate because exploitation requires the ability to exchange traffic as a peer on a configured PPP asynchronous link on the affected system and because only availability is affected. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Given the moderate impact rating and the constrained exposure, fixes for the affected products are currently deferred; the residual risk is that an attacker able to act as a peer on an established PPP asynchronous link can crash an affected system.