net: tap: fix wrong transport_header when sending VLAN-tagged frame
Summary
| CVE | CVE-2026-80905 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-04 18:18:00 UTC |
| Updated | 2026-09-04 18:18:00 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly. |
Risk And Classification
EPSS: 0.001550000 probability, percentile 0.049000000 (date 2026-09-07)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 8c76e77f9069f10505c08e02646c3ee11ad79038 5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b git | Not specified |
| CNA | Linux | Linux | affected 8c76e77f9069f10505c08e02646c3ee11ad79038 88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3 git | Not specified |
| CNA | Linux | Linux | affected 8c76e77f9069f10505c08e02646c3ee11ad79038 cbb35cbe8db268fefe34c23df15348cf99025298 git | Not specified |
| CNA | Linux | Linux | affected 3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1 git | Not specified |
| CNA | Linux | Linux | affected 4.20.1 4.21 semver | Not specified |
| CNA | Linux | Linux | affected 5.0 | Not specified |
| CNA | Linux | Linux | unaffected 5.0 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.46 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.10 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/cbb35cbe8db268fefe34c23df15348cf99025298 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.