CVE-2026-80925: Linux Kernel VLAN Race Condition Vulnerability

CVE-2026-80925 Overview

CVE-2026-80925 is a Linux kernel vulnerability in the VLAN (Virtual LAN) subsystem. Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower network device invokes vlan_transfer_features(), which dynamically mutates vlandev->hard_header_len. Lockless transmit paths read dev->hard_header_len without holding the RTNL lock, producing a data race. Upper layers can reserve insufficient headroom based on a stale value, causing skb_under_panic when vlan_dev_hard_header() is called. A concurrent mismatch between hard_header_len and header_ops compounds the issue.

Critical Impact
Local, unprivileged network operations that toggle VLAN offload features can trigger kernel panics through skb_under_panic, resulting in denial of service on affected Linux hosts.

Affected Products

Linux kernel VLAN (802.1Q) networking subsystem
Systems using NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX offload
Kernel builds prior to commits 447cbe95ebb9 and a29f3b884ba5

Discovery Timeline

2026-09-09 - CVE-2026-80925 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80925

Vulnerability Analysis

The defect is a kernel race condition [CWE-362] combined with a resource management flaw in the 802.1Q VLAN driver. When an administrator or userspace tool toggles hardware VLAN TX offload on a lower device, the kernel calls vlan_transfer_features(). That function mutates vlandev->hard_header_len at runtime.

The VLAN device relies on hard_header_len to communicate required headroom to upper layers. Callers such as packet_snd in af_packet.c and ip6_finish_output2 read this value on lockless TX paths without acquiring the RTNL lock. A stale read causes upper layers to allocate socket buffers with insufficient headroom for the VLAN tag.

When vlan_dev_hard_header() later attempts to prepend the VLAN header, skb_push() underflows the buffer and the kernel invokes skb_under_panic, halting the system.

Root Cause

The root cause is dynamic mutation of dev->hard_header_len under the assumption that all readers hold RTNL. Lockless TX paths violate that assumption. Additionally, vlan_transfer_features() updated hard_header_len without synchronizing changes to header_ops, creating a mismatch between allocated headroom and the header creation function actually used.

Attack Vector

Exploitation requires local access with the ability to toggle NIC offload features via ethtool or netlink on the lower device backing a VLAN interface. Concurrent traffic transmission through the VLAN device while offload features are toggled triggers the race and the resulting panic. See the upstream fixes at Kernel Git Commit 447cbe9 and Kernel Git Commit a29f3b8 for the code paths involved.

Detection Methods for CVE-2026-80925

Indicators of Compromise

Kernel panic messages containing the string skb_under_panic in dmesg or serial console output.
Stack traces referencing vlan_dev_hard_header, packet_snd, or ip6_finish_output2 at the time of crash.
Unexplained host reboots on systems running VLAN interfaces where offload flags were recently toggled.

Detection Strategies

Audit ethtool -k change events on interfaces that back VLAN devices for tx-vlan-offload or tx-vlan-stag-hw-insert transitions.
Correlate netlink RTM_SETLINK messages that modify feature flags with kernel oops or panic events.
Track kernel version and patch level across the fleet to identify unpatched hosts running the vulnerable VLAN code path.

Monitoring Recommendations

Forward kernel logs (/var/log/kern.log, journald) to a centralized log platform and alert on skb_under_panic and Kernel panic strings.
Monitor host availability metrics for unexpected reboot patterns on servers hosting VLAN sub-interfaces.
Baseline expected offload feature configurations and alert on unauthorized changes.

How to Mitigate CVE-2026-80925

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 447cbe95ebb9 and a29f3b884ba5 as soon as vendor-signed kernels become available.
Freeze changes to VLAN offload feature flags on production hosts until patched kernels are deployed.
Restrict access to CAP_NET_ADMIN so only authorized administrators can modify NIC offload settings.

Patch Information

The fix sets dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally. This keeps hard_header_len static and immutable, eliminates dynamic runtime updates that raced with lockless readers, and ensures LL_RESERVED_SPACE() always reserves sufficient headroom. vlan_header_ops is now used unconditionally. Reference the fixes at Kernel Git Commit 447cbe9 and Kernel Git Commit a29f3b8. Stable backports should also include commits e16e960d55a4 and cef51860becd for correct ipvlan and macvlan headroom inheritance.

Workarounds

Avoid toggling tx-vlan-offload and tx-vlan-stag-hw-insert on interfaces backing active VLAN sub-interfaces while traffic is flowing.
Set desired offload feature flags at boot before VLAN interfaces carry production traffic, then leave them unchanged.
Where feasible, drain traffic from VLAN interfaces before modifying lower-device features to reduce the race window.

bash

# Verify current VLAN offload settings on a lower device before changes
ethtool -k eth0 | grep -E 'tx-vlan'

# Restrict who can modify NIC features by limiting CAP_NET_ADMIN
# (example: audit users with the capability)
getcap -r / 2>/dev/null | grep cap_net_admin