Cloudanix VulnDB

CVE-2026-80906

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of network packets that carry VLAN tags can leave internal packet tracking information invalid, which may cause crashes or network failures on affected systems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect ordering of skb_probe_transport_header() and skb_set_network_header() in packet_parse_headers() leaves transport_header at its uninitialized sentinel (~0U) after VLAN tag processing, because the flow dissector receives the wrong protocol value and offset and fails to set the transport header.

Why it matters to the business

Linux systems that process VLAN-tagged traffic may experience network stack instability, crashes, or denial-of-service conditions affecting servers, routers, and containers that rely on the kernel packet path.

How an attack unfolds

An attacker crafts and sends a VLAN-tagged Ethernet frame; the receiving kernel invokes packet_parse_headers(), the misordered header probes cause the flow dissector to misinterpret the inner protocol bytes as a VLAN header, the probe fails, transport_header stays invalid, and subsequent use of the sentinel value triggers memory corruption or a crash.

How to fix it

Apply the upstream fix that moves skb_probe_transport_header() before skb_set_network_header() in packet_parse_headers(); rebuild and deploy the corrected kernel image; verify the change is present in the running kernel source.

How to confirm the fix worked

Confirm the corrected call order exists in net/packet/internal.h or af_packet.c; send synthetic VLAN-tagged frames in a test environment and verify transport_header is properly set via skb_transport_header() after parsing.

Typical attack path

  1. Craft a VLAN-tagged frame with an inner protocol header
  2. Transmit the frame to a vulnerable Linux host or device
  3. Trigger packet_parse_headers() via the receive path
  4. Force the flow dissector to fail on the misinterpreted VLAN case
  5. Leave transport_header uninitialized and induce later memory corruption or panic

How to detect it

Review kernel logs for oops, panics, or warnings originating from the packet or flow dissector paths; inspect network receive paths for frames that contain VLAN tags followed by unexpected protocol values; correlate with any processes or sockets using AF_PACKET.

What your security team should do

  • Prioritize kernel updates on all systems that handle VLAN traffic
  • Test the patched kernel with representative VLAN workloads before broad rollout
  • Monitor vendor advisories for distribution-specific backports
  • Restrict exposure of untrusted VLAN-tagged traffic to production kernels until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.

Affected packages

Ecosystem Package Introduced Fixed