CVE-2026-80742

In the Linux kernel, the following vulnerability has been resolved:

af packet: Don't send zero-byte data in tpacket snd().

syzbot reported a WARNING in dev queue xmit() triggered via tpacket snd():

skb assert len WARNING: at include/linux/skbuff.h:2753 skb assert len WARNING: at dev queue xmit+0x21bc/0x4970 net/core/dev.c:4781

Call Trace: dev queue xmit include/linux/netdevice.h:3448 [inline] packet xmit+0x243/0x310 net/packet/af packet.c:276 tpacket snd net/packet/af packet.c:2907 [inline] packet sendmsg+0x28d6/0x4eb0 net/packet/af packet.c:3134

When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard header len == 0), tpacket fill skb() populates an skb with skb->len == 0 and returns 0. tpacket snd() then forwards this empty skb to packet xmit(), causing dev queue xmit() to hit skb assert len(skb).

Similar checks exist in packet snd() via commit dc633700f00f ("net/af packet: check len when min header len equals to 0") and in packet sendmsg spkt() via commit 6a341729fb31 ("af packet: Don't send zero-byte data in packet sendmsg spkt().").

Return -EINVAL in tpacket fill skb() when skb->len is zero to reject zero-length packets in tpacket snd().