CVE-2026-80731 - Vulnerability Details

- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Description

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:

if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}

Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.

This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.

Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.

Published: 2026-09-03

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability involves an out-of-bounds memory write within the Linux kernel's dev_validate_header() function. The function pads short link-layer headers for processes with the CAP_SYS_RAWIO capability, and when the device's hard_header_len is altered concurrently, the memset can write beyond the allocated skb headroom. This memory corruption can compromise kernel data integrity. The CVE description does not explicitly state privilege escalation, but kernel memory corruption could lead to elevated privileges or system instability—a consequence that is inferred from the nature of the bug.

Affected Systems

All Linux kernel releases that include the zero‑padding code path for CAP_SYS_RAWIO holders are vulnerable. The specific vulnerable releases are not listed in the CVE data, so any kernel version prior to the patch that still contains this path should be considered at risk.

Risk and Exploitability

The bug requires local execution with the CAP_SYS_RAWIO capability, which is normally granted only to privileged processes. The CVSS base score of 7.8 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation, and it is not listed in CISA's KEV catalog. The most likely attack vector is a local privileged process triggering the problematic code path, potentially resulting in kernel memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b5518429e70cd783b8ca52335456172c1a0589f6`	affected	< 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 8fc9816404166a90ed8d544dc52482fafffb6d9f
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< b0f92a5731dc82556a9ae005cc35f71ab136307b
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 99df6b7a713f96eda206680d100b76e15f9d9b69
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 74e035f07f53feca09e2352e77fccb09cad5e208
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< dbb30dc943a93e083f1e531bfdc6779e57de40d0
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fc902f52a02298c7432b2334c0c82a2885a1a8b6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 3b9a324e646d3657a8d9806dfbfe4f3e4066e882
`f58a6c08ebdfa978178bbca78c2ba744a2665912`	affected	—
`1df16498dfd0d5a129bdf2982d9a08df73e8923d`	affected	—
`8b8d278aa4de9335682bbd4a3bb619af015c859e`	affected	—
`6804052fa9d86e9a512c88b24a5debbfc1a490fc`	affected	—
`3.2.80`	affected	< 3.2.81
`3.16.36`	affected	< 3.17
`4.1.28`	affected	< 4.2
`4.4.8`	affected	< 4.5
`4.5.2`	affected	< 4.6

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`3.2.81`	unaffected	≤ 3.2.*
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b5518429e70cd783b8ca52335456172c1a0589f6,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[f58a6c08ebdfa978178bbca78c2ba744a2665912,*]`	affected	code_commit	—
`[1df16498dfd0d5a129bdf2982d9a08df73e8923d,*]`	affected	code_commit	—
`[8b8d278aa4de9335682bbd4a3bb619af015c859e,*]`	affected	code_commit	—
`[6804052fa9d86e9a512c88b24a5debbfc1a490fc,*]`	affected	code_commit	—
`[3.2.80,3.2.81)`	affected	semver	—
`[3.16.36,3.17)`	affected	generic	—
`[4.1.28,4.2)`	affected	generic	—
`[4.4.8,4.5)`	affected	generic	—
`[4.5.2,4.6)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4.6,4.6]`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[3.2.81,3.2.*]`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.152,6.6.*]`	unaffected	generic	—
`[6.12.104,6.12.*]`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that removes the CAP_SYS_RAWIO zero‑padding branch in dev_validate_header()
If an update is unavailable, revoke the CAP_SYS_RAWIO capability from all non‑root users or applications that may call raw sockets
Reboot the system to ensure the new kernel code and capability restrictions are active

Generated by OpenCVE AI on September 4, 2026 at 07:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882
https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208
https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f
https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69
https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b
https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0
https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6

History

Fri, 04 Sep 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 04 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120 CWE-122

Fri, 04 Sep 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 03 Sep 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-122

Thu, 03 Sep 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
Title		net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882 https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208 https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69 https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0 https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-03T08:21:48.924Z

Updated: 2026-09-04T04:58:17.510Z

Reserved: 2026-08-26T14:34:25.789Z

Link: CVE-2026-80731

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-03T13:06:11.707

Modified: 2026-09-04T05:17:13.583

Link: CVE-2026-80731

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T08:00:16Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object