CVE-2026-80906

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers() function, skb set network header() is called to advance the network header past the VLAN tag. Subsequently, skb probe transport header() is called while the protocol is still set to the outer VLAN EtherType, but the network offset already points to the inner protocol header. Within skb flow dissect(), the dissector misinterprets the inner protocol header as a VLAN header via skb header pointer(), resulting in an invalid encapsulated EtherType. Consequently, skb set transport header() is never called, leaving the transport header at an uninitialized sentinel value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.