CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved:

net: packet: fix wrong transport header when sending VLAN-tagged frame

In packet parse headers(), when processing a VLAN-tagged frame, skb set network header() is called to advance network header past the VLAN tag to the inner protocol header. skb probe transport header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH P 8021Q), while nhoff (derived from skb network offset()) already points past the VLAN tag to the inner protocol header.

In skb flow dissect(), proto is initialized to ETH P 8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH P 8021Q, it reads a struct vlan hdr at nhoff via skb header pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb probe transport header() never calls skb set transport header(), leaving transport header at its uninitialized sentinel value (~0U).

Move skb probe transport header() to before skb set network header(). At the time skb probe transport header() is called, network header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport header to be set correctly.