net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80731
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-03 13:06:11 UTC
Updated2026-09-04 05:17:13 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001800000 probability, percentile 0.075820000 (date 2026-09-07)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b5518429e70cd783b8ca52335456172c1a0589f6 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace 8fc9816404166a90ed8d544dc52482fafffb6d9f git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace b0f92a5731dc82556a9ae005cc35f71ab136307b git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace 99df6b7a713f96eda206680d100b76e15f9d9b69 git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace 74e035f07f53feca09e2352e77fccb09cad5e208 git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace dbb30dc943a93e083f1e531bfdc6779e57de40d0 git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace fc902f52a02298c7432b2334c0c82a2885a1a8b6 git Not specified
CNA Linux Linux affected 2793a23aacbd754dbbb5cb75093deb7e4103bace 3b9a324e646d3657a8d9806dfbfe4f3e4066e882 git Not specified
CNA Linux Linux affected f58a6c08ebdfa978178bbca78c2ba744a2665912 git Not specified
CNA Linux Linux affected 1df16498dfd0d5a129bdf2982d9a08df73e8923d git Not specified
CNA Linux Linux affected 8b8d278aa4de9335682bbd4a3bb619af015c859e git Not specified
CNA Linux Linux affected 6804052fa9d86e9a512c88b24a5debbfc1a490fc git Not specified
CNA Linux Linux affected 3.2.80 3.2.81 semver Not specified
CNA Linux Linux affected 3.16.36 3.17 semver Not specified
CNA Linux Linux affected 4.1.28 4.2 semver Not specified
CNA Linux Linux affected 4.4.8 4.5 semver Not specified
CNA Linux Linux affected 4.5.2 4.6 semver Not specified
CNA Linux Linux affected 4.6 Not specified
CNA Linux Linux unaffected 4.6 semver Not specified
CNA Linux Linux unaffected 3.2.81 3.2.* semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report