CVE-2026-80905 Overview
CVE-2026-80905 is a Linux kernel vulnerability in the net/tap subsystem. The flaw affects tap_get_user_xdp() when it processes VLAN-tagged frames such as ETH_P_8021Q. The function calls skb_set_network_header() before skb_probe_transport_header(), causing the flow dissector to misinterpret the inner protocol header as a VLAN header. As a result, transport_header is left at its uninitialized sentinel value (~0U). Downstream code paths that rely on skb->transport_header can then read from an invalid offset, producing incorrect packet handling for VLAN-tagged XDP traffic on tap devices.
Critical Impact
The uninitialized transport_header field can propagate through kernel networking paths, leading to incorrect packet parsing and potential instability when VLAN-tagged frames are sent through tap devices used by virtualization workloads.
Affected Products
- Linux kernel versions containing the tap_get_user_xdp() VLAN handling code path
- Virtualization stacks that rely on tap devices with XDP (for example, QEMU/KVM guests using VLAN-tagged networking)
- Linux distributions shipping affected mainline and stable kernel branches
Discovery Timeline
- 2026-09-04 - CVE-2026-80905 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80905
Vulnerability Analysis
The defect exists in the tap driver's XDP receive path. When tap_get_user_xdp() handles a VLAN-tagged frame, it invokes skb_set_network_header() first, advancing network_header past the VLAN tag to the inner protocol header. The subsequent call to skb_probe_transport_header() then computes nhoff from skb_network_offset(), which now points past the VLAN tag, while skb->protocol still equals ETH_P_8021Q.
Inside __skb_flow_dissect(), the dissector enters the ETH_P_8021Q branch and reads a struct vlan_hdr at nhoff using __skb_header_pointer(). Because nhoff already points to the inner protocol header (for example, an IP header), those bytes are misinterpreted as a VLAN header. The extracted encapsulated EtherType matches no known protocol, the dissector returns false, and skb_set_transport_header() is never invoked. The transport_header field remains at the sentinel ~0U.
Root Cause
The root cause is an ordering bug between skb_set_network_header() and skb_probe_transport_header(). The dissector requires network_header to still point at the VLAN header so it can parse the tag and advance to the inner protocol. Setting the network header early breaks that invariant and desynchronizes skb->protocol from the offset the dissector consumes.
Attack Vector
The issue is triggered by sending VLAN-tagged frames through a tap device with XDP enabled. Local users or virtual machine guests that control a tap interface can produce the malformed skb state during normal traffic processing. Impact centers on incorrect packet metadata rather than a directly exploitable memory corruption primitive, but any downstream consumer that dereferences the sentinel transport_header value can behave incorrectly.
No verified exploit code is available. See the upstream fix commits for technical details: Kernel Git Commit 5ffaa5d, Kernel Git Commit 88b79ac, and Kernel Git Commit cbb35cb.
Detection Methods for CVE-2026-80905
Indicators of Compromise
- Kernel warnings or oops messages referencing tap_get_user_xdp, skb_probe_transport_header, or __skb_flow_dissect during VLAN traffic processing.
- Anomalous packet drops or malformed skb telemetry on tap interfaces attached to virtual machines that use 802.1Q VLAN tagging.
Detection Strategies
- Inventory running kernels against the fixed commits (5ffaa5d, 88b79ac, cbb35cb) and flag hosts still on vulnerable revisions.
- Correlate host-level kernel logs with virtualization workloads that use tap devices plus XDP programs to identify exposed systems.
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a central analytics platform and alert on repeated skb or flow-dissector warnings tied to tap devices.
- Monitor VM and container hosts for unexpected network parsing errors on interfaces carrying VLAN-tagged traffic.
How to Mitigate CVE-2026-80905
Immediate Actions Required
- Apply the upstream kernel patch that reorders skb_set_network_header() to run after skb_probe_transport_header() in tap_get_user_xdp().
- Update to a stable kernel release that incorporates commits 5ffaa5d7f56a, 88b79ac89ecc, or cbb35cbe8db2.
- For distribution kernels, install the vendor-supplied security update containing the backport.
Patch Information
The fix moves skb_set_network_header() to execute after skb_probe_transport_header(). At the time the dissector runs, network_header still points to the VLAN header at offset ETH_HLEN, so nhoff is correct. The flow dissector then parses the VLAN header, extracts the inner EtherType, advances nhoff, and allows transport_header to be set correctly. Reference commits: 5ffaa5d, 88b79ac, and cbb35cb.
Workarounds
- Disable XDP programs on tap interfaces that carry VLAN-tagged traffic until the patched kernel is deployed.
- Where possible, terminate VLAN tags on the host bridge rather than passing tagged frames into guest-facing tap devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
