Cloudanix VulnDB

CVE-2026-80841

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A memory handling error in the Linux kernel's network packet system could let attackers take over affected machines by manipulating certain low-level network operations.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel AF_PACKET TX_RING handling for vmalloc-backed ring blocks, caused by premature skb pending reference decrement before frame status writes and lack of recheck under lock during ring replacement, allowing late destructors to access freed mappings.

Why it matters to the business

Attackers could crash systems or escalate privileges on Linux hosts relying on packet sockets for networking or monitoring, disrupting services and requiring urgent kernel updates across fleets.

How an attack unfolds

An attacker opens an AF_PACKET socket, allocates a TX_RING mixing vmalloc-backed blocks, sends skbs while racing socket close or ring swap operations to trigger the UAF in tpacket_destruct_skb or late frame access after pg_vec detach, then leverages the freed memory for corruption or code execution.

How to fix it

Apply the upstream kernel patch that defers vmalloc TX_RING free until skbs finish, moves pending_refcnt release to packet_sock_destruct, adds pg_vec_lock recheck, and uses socket write-memory accounting for deferred lifetime; rebuild and reboot to the fixed kernel version.

How to confirm the fix worked

Confirm kernel version contains the commit moving decrement after TP_STATUS_AVAILABLE stores and adding deferred work for vmalloc vectors; test ring allocation with vmalloc blocks and verify no UAF under concurrent send/close workloads.

Typical attack path

  1. Create AF_PACKET socket and configure TX_RING with vmalloc allocations
  2. Send packets to populate skbs referencing ring frames
  3. Trigger concurrent socket release or ring replacement under pg_vec_lock race
  4. Access or corrupt freed vmalloc mapping via late destructor or status write
  5. Escalate via kernel memory corruption primitives

How to detect it

Search kernel logs for oops or warnings referencing tpacket_destruct_skb, packet_sock_destruct, or vmalloc pg_vec during socket close; monitor for anomalous AF_PACKET socket activity followed by crashes or memory corruption indicators.

What your security team should do

  • Prioritize kernel upgrades on systems exposing AF_PACKET sockets to untrusted users or containers
  • Monitor EPSS and exploit maturity for any rise indicating public PoCs
  • Restrict CAP_NET_RAW and AF_PACKET usage via seccomp or LSM policies where feasible
  • Audit custom networking tools or packet capture software for direct TX_RING usage

The record

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping. tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.

Affected packages

Ecosystem Package Introduced Fixed