CVE-2026-80905
Received Received - Intake

Incorrect Transport Header Assignment in Linux Kernel TAP Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80905
EUVD
EUVD-2026-71664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of VLAN-tagged network frames. When sending such frames, the transport header is not set properly due to misaligned header offsets, leaving it uninitialized. This occurs because the network header is advanced too early, causing the flow dissector to misinterpret protocol headers.

Detection Guidance

This vulnerability is specific to the Linux kernel's TAP driver and may not have direct network detection commands. Monitor kernel logs for errors related to VLAN-tagged frames or TAP interfaces. Check for crashes or unusual behavior in network services using TAP interfaces.

Impact Analysis

This flaw could lead to network packet processing errors, potentially causing crashes or unexpected behavior in systems using the Linux kernel with TAP devices. It may disrupt network traffic handling, especially in virtualized or containerized environments.

Compliance Impact

This vulnerability affects network packet handling in the Linux kernel, specifically related to VLAN-tagged frames. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than network packet processing errors.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, avoid using VLAN-tagged frames with TAP interfaces until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart