CVE-2026-80841 Overview
CVE-2026-80841 is a Linux kernel vulnerability in the net/packet subsystem affecting AF_PACKET sockets configured with TX_RING. Transmit ring skbs retain raw pointers into ring frames, but page references do not preserve a vmalloc mapping when pg_vec is freed. A late destructor can therefore write timestamp and status fields into memory that has already been released. The flaw also permits a race where a concurrent send can queue a pending skb between the initial pending check and a non-closing ring replacement.
Critical Impact
Use-after-free of vmalloc-backed AF_PACKET TX ring memory can lead to kernel memory corruption, information disclosure, or denial of service on affected Linux systems.
Affected Products
- Linux kernel net/packet (AF_PACKET) subsystem
- Distributions shipping kernels prior to the fix commits 0189dce0, 550d00aa, 992cc9f9, and ed25ed29
- Systems where unprivileged or CAP_NET_RAW processes can create AF_PACKET sockets with PACKET_TX_RING
Discovery Timeline
- 2026-09-04 - CVE-2026-80841 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-80841
Vulnerability Analysis
The defect is a use-after-free [CWE-416] and race condition in the AF_PACKET transmit ring path. When a process installs a PACKET_TX_RING, the kernel allocates a pg_vec of blocks that may be page-backed or vmalloc-backed depending on size. Each in-flight skb derived from a ring slot holds a raw pointer to its frame and relies on tpacket_destruct_skb() to write the completion timestamp and set TP_STATUS_AVAILABLE before releasing its pending reference.
The original ordering dropped the pending reference before the frame stores, allowing a socket close to tear down pg_vec while a late destructor still touched the frame. Page-backed blocks survived through skb page references, but vmalloc mappings did not, producing a use-after-free against unmapped kernel virtual addresses. A second issue allowed a concurrent sendmsg() to enqueue a pending TX skb between the pending-frame check and a non-closing ring swap, reintroducing the same dangling reference.
Root Cause
The root cause is lifetime mismatch between AF_PACKET TX skbs and their backing ring storage. Page references preserve page-backed blocks but do not extend to vmalloc mappings, and the pending refcount was decremented before the ring frame was fully written. Ring replacement paths did not recheck pending frames under pg_vec_lock.
Attack Vector
A local process able to open an AF_PACKET socket and configure PACKET_TX_RING can trigger the condition by racing socket close or ring replacement against outstanding TX completions on a vmalloc-backed ring. Exploitation requires the ability to create packet sockets, typically gated by CAP_NET_RAW or unprivileged user namespaces where enabled. Successful exploitation can corrupt freed kernel memory or crash the kernel.
No verified public proof-of-concept code is available. See the upstream fix commits for the authoritative technical description: Kernel Git Commit 0189dce, Kernel Git Commit 550d00a, Kernel Git Commit 992cc9f9, and Kernel Git Commit ed25ed29.
Detection Methods for CVE-2026-80841
Indicators of Compromise
- Kernel oops or BUG: messages referencing tpacket_destruct_skb, packet_release, packet_set_ring, or pg_vec on vmalloc addresses.
- KASAN use-after-free reports naming af_packet.c frames or TP_STATUS_AVAILABLE stores.
- Unexpected process crashes or kernel panics on hosts running packet capture, DPDK-adjacent, or custom raw-socket tooling.
Detection Strategies
- Inventory kernel versions across Linux fleets and flag hosts running versions preceding the fix commits listed in the vendor advisories.
- Audit processes and containers that hold CAP_NET_RAW or create AF_PACKET sockets with PACKET_TX_RING via syscall telemetry (socket(AF_PACKET,...), setsockopt(..., PACKET_TX_RING, ...)).
- Correlate kernel log anomalies with recent packet-socket ring resizing or process exit events.
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized log store and alert on KASAN or oops signatures involving af_packet.
- Track workloads that enable unprivileged user namespaces, since they broaden the pool of processes that can reach this code path.
- Monitor for repeated crashes on the same host, which may indicate exploitation attempts or unstable in-house tooling.
How to Mitigate CVE-2026-80841
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the fix commits and reboot affected systems.
- Prioritize multi-tenant hosts, container platforms, and systems that expose CAP_NET_RAW to untrusted workloads.
- Track distribution advisories from your Linux vendor and stage the corresponding stable-kernel update.
Patch Information
The fix is delivered by four upstream commits: Kernel Git Commit 0189dce, Kernel Git Commit 550d00a, Kernel Git Commit 992cc9f9, and Kernel Git Commit ed25ed29. The fix moves the pending refcount decrement in tpacket_destruct_skb() after the frame status stores, rechecks pending TX frames under pg_vec_lock before non-closing ring replacement, defers vmalloc-backed pg_vec teardown to system_long_wq while TX skbs remain, and relocates pending_refcnt release to packet_sock_destruct().
Workarounds
- Restrict CAP_NET_RAW to trusted processes and remove it from container capability sets that do not need raw sockets.
- Disable unprivileged user namespaces where operationally acceptable by setting kernel.unprivileged_userns_clone=0 or the equivalent distro control.
- Use seccomp or LSM policies to block socket(AF_PACKET, ...) for workloads that do not require it.
# Reduce exposure by restricting AF_PACKET and CAP_NET_RAW
sysctl -w kernel.unprivileged_userns_clone=0
# Drop CAP_NET_RAW from a container (example: Docker)
docker run --cap-drop=NET_RAW <image>
# Verify running kernel version against distro advisories
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
