{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames  rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb-\u003edev NULL. __rmnet_map_ingress_handler() assigns skb-\u003edev = ep-\u003eegress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb-\u003edev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame carrying a flow-control command to the tap fd.  Restore the assignment dropped by 378e25357ac7, so every skb leaving rmnet_map_deaggregate() has a valid device.    BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)   Write of size 4 at addr 00000000000004b4 by task exploit/144   Call Trace:    _raw_spin_lock (kernel/locking/spinlock.c:158)    netif_tx_lock (net/sched/sch_generic.c:497)    rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67)    rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125)    __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103)    ...    __netif_receive_skb_one_core (net/core/dev.c:6214)    netif_receive_skb (net/core/dev.c:6474)    tun_get_user (drivers/net/tun.c:1966)    tun_chr_write_iter (drivers/net/tun.c:2012)    vfs_write (fs/read_write.c:687)    ksys_write (fs/read_write.c:739)    do_syscall_64 (arch/x86/entry/syscall_64.c:94)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)   Kernel panic - not syncing: Fatal exception in interrupt",
  "id": "DEBIAN-CVE-2026-89780",
  "modified": "2026-09-17T04:47:36.166843799Z",
  "published": "2026-09-16T09:17:08.520Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89780"
    }
  ],
  "upstream": [
    "CVE-2026-89780"
  ]
}