CVE-2026-80841
Received Received - Intake

Linux Kernel AF_PACKET TX_RING Use-After-Free Vulnerability

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping. tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80841
EUVD
EUVD-2026-71291

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the AF_PACKET TX_RING mechanism. When TX_RING skbs hold raw pointers to ring frames, the vmalloc mapping may be freed prematurely while skbs still reference it. The issue arises because tpacket_destruct_skb() drops pending references before writing timestamp and status updates, potentially leading to use-after-free scenarios. The fix ensures proper ordering of operations and deferred cleanup of vmalloc-backed blocks.

Detection Guidance

This vulnerability is specific to the Linux kernel's AF_PACKET TX_RING implementation and does not have direct network or system detection commands. It requires kernel-level inspection for signs of memory corruption or improper skb handling in packet ring buffers. Monitor kernel logs for warnings or errors related to packet sockets or memory allocation failures.

Impact Analysis

An attacker could exploit this to cause a denial-of-service by crashing the system or potentially execute arbitrary code with kernel privileges. Systems using AF_PACKET with TX_RING functionality may be vulnerable to memory corruption or instability.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this issue. If immediate patching is not possible, restrict access to AF_PACKET sockets via kernel module blacklisting or system policies. Monitor for unusual network activity or memory corruption symptoms in packet processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart