CVE-2026-80841

In the Linux kernel, the following vulnerability has been resolved:

net/packet: defer vmalloc TX RING free until skbs finish

AF PACKET TX RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg vec is freed, but they do not preserve a vmalloc mapping.

tpacket destruct skb() currently drops the pending reference before writing the timestamp and TP STATUS AVAILABLE to the frame. Move the decrement after those stores. The smp wmb() in packet set status() orders the frame stores before the decrement.

Also recheck pending TX frames under pg vec lock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap.

Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pg vec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to system long wq.

After pg vec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sock wfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain.

Move pending refcnt release to packet sock destruct() so late skb destructors and deferred cleanup can safely use it after packet release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.