CVE-2026-80742
Received Received - Intake

Linux kernel af_packet Zero-Length Packet Validation Bypass

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd(): skb_assert_len WARNING: at include/linux/skbuff.h:2753 skb_assert_len WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781 Call Trace: <TASK> dev_queue_xmit include/linux/netdevice.h:3448 [inline] packet_xmit+0x243/0x310 net/packet/af_packet.c:276 tpacket_snd net/packet/af_packet.c:2907 [inline] packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134 When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb() populates an skb with skb->len == 0 and returns 0. tpacket_snd() then forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to hit skb_assert_len(skb). Similar checks exist in packet_snd() via commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0") and in packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send zero-byte data in packet_sendmsg_spkt()."). Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject zero-length packets in tpacket_snd().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-80742
EUVD
EUVD-2026-70346

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the af_packet module where sending zero-byte packets through the TPACKET ring buffer triggers a kernel warning. The issue occurs when devices lack a hard header, causing tpacket_fill_skb() to create an empty socket buffer (skb) with zero length. This empty skb is then passed to __dev_queue_xmit(), which asserts the skb length, leading to a warning in the kernel.

Detection Guidance

This vulnerability is specific to the Linux kernel's af_packet implementation and may not have direct detection commands. Monitor kernel logs for WARNING messages related to skb_assert_len or __dev_queue_xmit() after sending zero-byte packets via TPACKET ring buffers. Check if your system uses devices with no hard header (dev->hard_header_len == 0).

Commands to check kernel logs: dmesg | grep skb_assert_len or journalctl -k | grep skb_assert_len. Inspect network interfaces with ip link or ifconfig to identify devices with hard_header_len == 0.

Impact Analysis

This vulnerability may cause kernel warnings or crashes when zero-byte packets are sent via TPACKET ring buffers on devices without a hard header. It could lead to system instability or unexpected behavior in network operations, potentially disrupting services relying on packet transmission.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue by updating to a version containing the fix for af_packet's tpacket_snd() function. Avoid sending zero-byte packets via TPACKET ring buffers on affected devices until patched.

Temporarily disable TPACKET ring buffer usage if zero-byte packets are not required. Monitor vendor advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart