CVE-2026-80905

In the Linux kernel, the following vulnerability has been resolved:

net: tap: fix wrong transport header when sending VLAN-tagged frame

In tap get user xdp(), when processing a VLAN-tagged frame (e.g. ETH P 8021Q), skb set network header() is called first to advance network header past the VLAN tag to the inner protocol header. skb probe transport header() is then called with skb->protocol still set to ETH P 8021Q, while nhoff (derived from skb network offset()) already points past the VLAN tag to the inner protocol header.

In skb flow dissect(), proto is initialized to ETH P 8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH P 8021Q, it reads a struct vlan hdr at the current nhoff via skb header pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb probe transport header() never calls skb set transport header(), leaving transport header at its uninitialized sentinel value (~0U).

Move skb set network header() to after skb probe transport header(). At the time skb probe transport header() is called, network header still points to the VLAN header (offset ETH HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport header to be set correctly.