CVE-2026-80906 Overview
CVE-2026-80906 is a Linux kernel networking flaw in the AF_PACKET subsystem. The defect lives in packet_parse_headers() and mis-sequences header parsing when transmitting VLAN-tagged frames. The skb_set_network_header() call advances network_header past the VLAN tag before skb_probe_transport_header() runs. The flow dissector then reads inner-protocol bytes as if they were a vlan_hdr, fails to identify the encapsulated EtherType, and leaves transport_header at its uninitialized sentinel value (~0U). Downstream consumers that trust transport_header receive an invalid offset, producing incorrect packet processing on VLAN egress paths.
Critical Impact
The uninitialized transport_header propagates into packet processing paths, causing incorrect segmentation, checksum, or offload decisions on VLAN-tagged traffic sent via AF_PACKET sockets.
Affected Products
- Linux kernel (upstream net/packet subsystem)
- Stable branches receiving the referenced backport commits
- Distributions shipping kernels prior to the fix
Discovery Timeline
- 2026-09-04 - CVE-2026-80906 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80906
Vulnerability Analysis
The defect resides in packet_parse_headers() within the Linux kernel AF_PACKET transmit path. When a userland process sends a VLAN-tagged frame through a packet socket, the function calls skb_set_network_header() to shift network_header past the 4-byte VLAN tag. It then invokes skb_probe_transport_header(), which internally runs __skb_flow_dissect() to locate the transport layer.
At dissection time, skb->protocol still holds the outer EtherType ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag. The dissector enters the case ETH_P_8021Q branch and reads a struct vlan_hdr at nhoff using __skb_header_pointer(). Those bytes actually belong to the inner header, typically an IP header, and are misinterpreted as a VLAN descriptor.
The extracted encapsulated EtherType matches no known protocol, so the dissector returns false. Because skb_probe_transport_header() never calls skb_set_transport_header(), the transport_header field remains at its uninitialized sentinel ~0U. Any subsequent code path that dereferences the transport header offset operates on garbage state.
Root Cause
The root cause is an ordering bug between header-offset mutation and flow dissection. skb_probe_transport_header() requires network_header to point at the outermost header its dissector understands. Advancing the offset first breaks the dissector's expectation and produces an invalid parse.
Attack Vector
The code path is reachable by any local process able to open an AF_PACKET socket and transmit a VLAN-tagged frame. No CWE has been assigned and no exploit is published. The observable effect is functional corruption of transport_header, which impacts downstream kernel networking logic that relies on that offset.
See the upstream fix in the Linux Kernel Commit Fix, which reorders skb_probe_transport_header() before skb_set_network_header() so the dissector observes the VLAN header at the correct offset.
Detection Methods for CVE-2026-80906
Indicators of Compromise
- No public indicators of compromise are associated with CVE-2026-80906 at this time.
- Unexpected packet drops, malformed VLAN egress traffic, or checksum errors on hosts using AF_PACKET senders may indicate impact.
Detection Strategies
- Inventory running kernel versions across Linux fleets and compare against the fixed stable releases listed in the upstream commits.
- Audit workloads that use raw or packet sockets (for example, DHCP relays, packet capture tools, and network testers) for VLAN-tagged transmit patterns.
- Correlate kernel warnings or netdev subsystem log anomalies with VLAN traffic generation events.
Monitoring Recommendations
- Track kernel package versions through your configuration management and vulnerability management tooling.
- Monitor process telemetry for creation of AF_PACKET sockets by unexpected user accounts.
- Watch for abnormal rates of malformed egress frames on VLAN-tagged interfaces via switch counters and NIC statistics.
How to Mitigate CVE-2026-80906
Immediate Actions Required
- Apply the upstream fix or the vendor-provided kernel update that includes the reordered skb_probe_transport_header() call.
- Prioritize hosts that rely on AF_PACKET transmission of VLAN-tagged frames, such as virtualization hosts, network appliances, and traffic generators.
- Reboot into the patched kernel to activate the fix, as this defect resides in kernel code.
Patch Information
The fix is available across multiple stable branches. Reference the upstream commits: Linux Kernel Commit Update, Linux Kernel Commit Correction, Linux Kernel Commit Improvement, Linux Kernel Commit Fix, Linux Kernel Commit Change, Linux Kernel Commit Adjustment, Linux Kernel Commit Enhancement, and Linux Kernel Commit Modification.
Workarounds
- Restrict CAP_NET_RAW so only trusted workloads can open AF_PACKET sockets.
- Avoid transmitting VLAN-tagged frames from userland via AF_PACKET on unpatched kernels; delegate VLAN tagging to the kernel VLAN interface (for example, eth0.100).
- Contain sensitive workloads inside namespaces or minimal container profiles that drop raw packet capabilities until the kernel is patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
