CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP SYS RAWIO zero-padding in dev validate header

dev validate header() reads dev->hard header len directly when zero-padding short link layer headers for CAP SYS RAWIO holders:

if (capable(CAP SYS RAWIO)) { memset(ll header + len, 0, dev->hard header len - len); return true; }

Packet send paths call dev validate header() on skbs whose headroom was allocated from an earlier hard header len read. If the device is reconfigured so that dev->hard header len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK RAW paths today because the same concurrent increase can first make skb push() exceed the reserved headroom and trigger skb under panic(). Remove the zero-padding branch before making those hard header len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite.

This path is only reached for variable length L2 protocols, where len < hard header len but len >= min header len. No remaining in-tree variable length L2 protocol implements header ops->validate, and the CAP SYS RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input.

Drop the CAP SYS RAWIO branch. The remaining reads of dev->hard header len in dev validate header() are comparisons only and have no memory safety impact.