CVE-2026-80906
Received Received - Intake

Packet Header Miscalculation in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80906
EUVD
EUVD-2026-71665

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of VLAN-tagged network frames. When sending such frames, the code misplaces the transport header pointer due to improper sequencing of header parsing functions. This causes the system to misinterpret the inner protocol header as a VLAN header, leading to protocol confusion and potential data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's packet handling and may not have direct detection commands. However, you can check your kernel version for affected releases and monitor for network-related issues like incorrect transport header parsing or VLAN-tagged frame mishandling.

Impact Analysis

This flaw could cause network applications to malfunction or crash due to incorrect header parsing. It may lead to data corruption, protocol errors, or unexpected behavior in network services relying on accurate header information. Systems processing VLAN-tagged traffic are most at risk.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If you are using a vulnerable kernel version, apply the patch provided by your distribution or compile a patched kernel from source.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart