Cloudanix VulnDB

CVE-2026-80905

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux networking bug can cause packets that use VLAN tags to be handled incorrectly inside the kernel, which may disrupt network traffic or cause unexpected errors on systems using certain virtual network interfaces.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

skb_probe_transport_header fails to set transport_header for VLAN-tagged frames because skb_set_network_header advances the offset before the flow dissector runs, causing __skb_flow_dissect to misread the inner protocol header as a vlan_hdr when proto remains ETH_P_8021Q.

Why it matters to the business

Networking components that rely on TAP devices with VLAN tagging may experience malformed packet handling, leading to dropped traffic, unexpected behavior in protocol stacks, or kernel-level faults on affected Linux systems.

How an attack unfolds

An attacker crafts and injects a VLAN-tagged Ethernet frame (ETH_P_8021Q) into a TAP interface; the kernel path tap_get_user_xdp calls skb_set_network_header first, then skb_probe_transport_header, which invokes the dissector on an incorrect offset, leaving transport_header at its sentinel value and causing subsequent packet processing to operate on uninitialized header data.

How to fix it

Apply the upstream kernel patch that reorders the calls so skb_probe_transport_header executes before skb_set_network_header; rebuild and deploy the corrected kernel image on all affected systems.

How to confirm the fix worked

Confirm the source change moves skb_set_network_header after skb_probe_transport_header; test by injecting VLAN-tagged frames and verifying that transport_header is correctly populated via skb_transport_header or packet capture tools.

Typical attack path

  1. Send a VLAN-tagged frame through a userspace TAP device
  2. Kernel invokes tap_get_user_xdp and executes skb_set_network_header before skb_probe_transport_header
  3. Flow dissector receives nhoff past the VLAN tag but proto still set to ETH_P_8021Q
  4. Dissector misinterprets inner header bytes as vlan_hdr and returns false
  5. transport_header remains uninitialized, producing incorrect packet metadata for later stack layers

How to detect it

Inspect kernel ring buffer and system logs for unexpected failures or warnings originating from the flow dissector or skb_probe_transport_header when processing VLAN frames; examine network packet traces for malformed transport headers on TAP interfaces.

What your security team should do

  • Prioritize patching kernel packages containing the tap driver on any system exposing TAP interfaces to untrusted traffic
  • Monitor upstream stable branches for the merged fix and schedule kernel updates within standard maintenance windows
  • Review network configurations that rely on VLAN tagging over TAP devices for exposure level

The record

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.

Affected packages

Ecosystem Package Introduced Fixed