CVE-2026-80731 - Vulnerability Details

- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Description

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:

if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}

Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.

This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.

Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.

Published: 2026-09-03

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds write in the Linux kernel’s dev_validate_header() function can corrupt kernel memory when a process with the CAP_SYS_RAWIO capability triggers the zero‑padding branch. The vulnerability writes past the reserved skb headroom buffer, which can allow a privileged user to overwrite critical kernel data and potentially gain root privileges.

Affected Systems

All Linux kernel releases that contain the zero‑padding code path for CAP_SYS_RAWIO holders are affected. The specific affected kernel versions are not enumerated in the CVE information provided, but any release before the fix should be considered vulnerable.

Risk and Exploitability

The bug requires local execution with CAP_SYS_RAWIO, a capability normally granted only to already privileged users. Because the exploit writes directly to kernel memory, its impact is severe (local privilege escalation). No EPSS or KEV data is available, so the risk assessment relies on the nature of the memory corruption and the requirement for privileged execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b5518429e70cd783b8ca52335456172c1a0589f6`	affected	< 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 8fc9816404166a90ed8d544dc52482fafffb6d9f
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< b0f92a5731dc82556a9ae005cc35f71ab136307b
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 99df6b7a713f96eda206680d100b76e15f9d9b69
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 74e035f07f53feca09e2352e77fccb09cad5e208
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< dbb30dc943a93e083f1e531bfdc6779e57de40d0
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fc902f52a02298c7432b2334c0c82a2885a1a8b6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 3b9a324e646d3657a8d9806dfbfe4f3e4066e882
`f58a6c08ebdfa978178bbca78c2ba744a2665912`	affected	—
`1df16498dfd0d5a129bdf2982d9a08df73e8923d`	affected	—
`8b8d278aa4de9335682bbd4a3bb619af015c859e`	affected	—
`6804052fa9d86e9a512c88b24a5debbfc1a490fc`	affected	—
`3.2.80`	affected	< 3.2.81
`3.16.36`	affected	< 3.17
`4.1.28`	affected	< 4.2
`4.4.8`	affected	< 4.5
`4.5.2`	affected	< 4.6

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`3.2.81`	unaffected	≤ 3.2.*
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b5518429e70cd783b8ca52335456172c1a0589f6,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[f58a6c08ebdfa978178bbca78c2ba744a2665912,*]`	affected	code_commit	—
`[1df16498dfd0d5a129bdf2982d9a08df73e8923d,*]`	affected	code_commit	—
`[8b8d278aa4de9335682bbd4a3bb619af015c859e,*]`	affected	code_commit	—
`[6804052fa9d86e9a512c88b24a5debbfc1a490fc,*]`	affected	code_commit	—
`[3.2.80,3.2.81)`	affected	semver	—
`[3.16.36,3.17)`	affected	generic	—
`[4.1.28,4.2)`	affected	generic	—
`[4.4.8,4.5)`	affected	generic	—
`[4.5.2,4.6)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4.6,4.6]`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[3.2.81,3.2.*]`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.152,6.6.*]`	unaffected	generic	—
`[6.12.104,6.12.*]`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that removes the CAP_SYS_RAWIO zero‑padding branch in dev_validate_header()
If an update is unavailable, re‑voke the CAP_SYS_RAWIO capability from all non‑root users or applications that may call raw sockets
Reboot the system to ensure the new kernel code and capability restrictions are active

Generated by OpenCVE AI on September 3, 2026 at 12:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00244.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882
https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208
https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f
https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69
https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b
https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0
https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6

History

Thu, 03 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-122

Thu, 03 Sep 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
Title		net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882 https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208 https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69 https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0 https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-03T08:21:48.924Z

Updated: 2026-09-03T08:21:48.924Z

Reserved: 2026-08-26T14:34:25.789Z

Link: CVE-2026-80731

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-03T13:06:11.707

Modified: 2026-09-03T13:06:11.707

Link: CVE-2026-80731

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T12:30:04Z

Weaknesses

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-122
Heap-based Buffer Overflow

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object