PT-2026-89095 · Linux · Linux
CVE-2026-80925
·
Published
2026-09-09
·
Updated
2026-09-09
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
vlan: fix skb under panic and races when toggling HW VLAN offload
Toggling hardware VLAN TX offload (NETIF F HW VLAN CTAG TX or
NETIF F HW VLAN STAG TX) on a lower device invokes vlan transfer features(),
which dynamically changed vlandev->hard header len.
This causes two issues:
- Lockless TX paths (e.g. packet snd in af packet.c, ip6 finish output2) read dev->hard header len without holding RTNL lock. Mutating hard header len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard header len, resulting in skb under panic when vlan dev hard header() is called.
- In addition, vlan transfer features() updated hard header len without updating header ops, causing a mismatch between allocated headroom and header creation.
Always setting dev->hard header len = real dev->hard header len and
dev->needed headroom = real dev->needed headroom + VLAN HLEN unconditionally
ensures:
- dev->hard header len remains 100% static and immutable at real dev->hard header len, eliminating all dynamic runtime updates and data races on hard header len.
- Upper layers allocating skbs via LL RESERVED SPACE() will always reserve sufficient headroom for software VLAN tag insertion (real dev->hard header len + real dev->needed headroom + VLAN HLEN).
- vlandev inherits real dev->needed tailroom so underlying trailer/padding/ICV requirements are honored.
- AF PACKET SOCK RAW network header offsets remain correctly aligned at real dev->hard header len.
- vlan header ops is used unconditionally.
Note to stable teams: Make sure to backport these commits:
e16e960d55a4 ("ipvlan: inherit needed headroom and needed tailroom from phy dev")
cef51860becd ("macvlan: inherit needed headroom and needed tailroom from lowerdev")
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux