CVE-2026-80906 - Vulnerability Details

- net: packet: fix wrong transport_header when sending VLAN-tagged frame

Description

In the Linux kernel, the following vulnerability has been resolved:

net: packet: fix wrong transport_header when sending VLAN-tagged frame

In packet_parse_headers(), when processing a VLAN-tagged frame,
skb_set_network_header() is called to advance network_header past the
VLAN tag to the inner protocol header. skb_probe_transport_header() is
then called with skb->protocol still set to the outer VLAN EtherType
(e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset())
already points past the VLAN tag to the inner protocol header.

In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff
points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it
reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that
offset contains the inner protocol header (e.g. an IP header). The bytes
are misinterpreted as a VLAN header, yielding a garbage encapsulated
EtherType that matches no known protocol. The dissector returns false,
so skb_probe_transport_header() never calls skb_set_transport_header(),
leaving transport_header at its uninitialized sentinel value (~0U).

Move skb_probe_transport_header() to before skb_set_network_header(). At
the time skb_probe_transport_header() is called, network_header still
points to the VLAN header, so nhoff correctly points to the VLAN header.
The flow dissector can then parse the VLAN header, extract the inner
EtherType, and advance nhoff to the inner protocol header, allowing
transport_header to be set correctly.

Published: 2026-09-04

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs when the kernel misorders the parsing of VLAN‑tagged frames, causing the inner protocol header to be read as a VLAN header. This misinterpretation leaves the transport_header at an uninitialized value, which can disrupt subsequent packet processing and potentially cause the system to drop or mishandle traffic. The weakness reflects improper initialization of essential packet state, weakening the reliability of the network stack.

Affected Systems

All Linux kernel versions that have not incorporated the fix found in the provided patches. The vulnerability applies to generic Linux kernels, affecting any deployment that processes VLAN‑tagged frames using the legacy packet parsing routine.

Risk and Exploitability

No publicly documented exploit exists, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is unavailable, and a CVSS score is not provided. Based on the available data, the risk is low to moderate: the flaw is a kernel internal error that may only be triggered by specific VLAN traffic and can lead to denial of service rather than remote code execution. Attackers would need to manipulate network traffic to exploit the misparsing path, so the likelihood of exploitation is limited by the exposure of the vulnerable network interface.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c2137d565ceb505de69593c181a0543bc4083838`	affected	< a4b82de96d465ddb44bc931145c0fa80c4fe9c9c
`9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8`	affected	< fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< 5479eb9b355f44745d7ccfe112386bd4f96eceea
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< e451e20adb869a983a21dda158625f024142e61f
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< 6971cf319263d6a1b4096f9248aca9e57d77a1eb
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< f9297abbcaba760b7a7b9d63b839f607f738013e
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< 6386a6ffa2efba2965ed8e4fa303582c0b76a215
`dfed913e8b55a0c2c4906f1242fd38fd9a116e49`	affected	< 01fdecc0480d916c799dbee584833a4a37e94d06
`ad3f90a9c4a2c74bb3711f2031bffda4ec44c849`	affected	—
`5.10.163`	affected	< 5.10.266
`5.15.87`	affected	< 5.15.217
`5.4.229`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c2137d565ceb505de69593c181a0543bc4083838,a4b82de96d465ddb44bc931145c0fa80c4fe9c9c)`	affected	code_commit	—
`[9ff46c36df2e0a1ac352f2f4038eaf3f0f7361b8,fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,5479eb9b355f44745d7ccfe112386bd4f96eceea)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,e451e20adb869a983a21dda158625f024142e61f)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,6971cf319263d6a1b4096f9248aca9e57d77a1eb)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,f9297abbcaba760b7a7b9d63b839f607f738013e)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,6386a6ffa2efba2965ed8e4fa303582c0b76a215)`	affected	code_commit	—
`[dfed913e8b55a0c2c4906f1242fd38fd9a116e49,01fdecc0480d916c799dbee584833a4a37e94d06)`	affected	code_commit	—
`ad3f90a9c4a2c74bb3711f2031bffda4ec44c849`	affected	code_commit	—
`[5.10.163,5.10.266)`	affected	semver	—
`[5.15.87,5.15.217)`	affected	semver	—
`[5.4.229,5.5)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	generic	—
`[0,5.19)`	unaffected	generic	—
`[5.10.266,5.10.*]`	unaffected	generic	—
`[5.15.217,5.15.*]`	unaffected	generic	—
`[6.1.184,6.1.*]`	unaffected	generic	—
`[6.6.153,6.6.*]`	unaffected	generic	—
`[6.12.105,6.12.*]`	unaffected	generic	—
`[6.18.46,6.18.*]`	unaffected	generic	—
`[7.1.10,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fix for this issue or apply the upstream patch indicated by the commit references
If a kernel update is not immediately possible, restrict or disable VLAN tagging on critical interfaces to prevent malformed frames from reaching the packet parsing path
Continuously monitor kernel logs and system stability indicators for signs of dropped or malformed packets that may suggest an underlying parsing error

Generated by OpenCVE AI on September 4, 2026 at 19:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01fdecc0480d916c799dbee584833a4a37e94d06
https://git.kernel.org/stable/c/5479eb9b355f44745d7ccfe112386bd4f96eceea
https://git.kernel.org/stable/c/6386a6ffa2efba2965ed8e4fa303582c0b76a215
https://git.kernel.org/stable/c/6971cf319263d6a1b4096f9248aca9e57d77a1eb
https://git.kernel.org/stable/c/a4b82de96d465ddb44bc931145c0fa80c4fe9c9c
https://git.kernel.org/stable/c/e451e20adb869a983a21dda158625f024142e61f
https://git.kernel.org/stable/c/f9297abbcaba760b7a7b9d63b839f607f738013e
https://git.kernel.org/stable/c/fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac

History

Fri, 04 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
Title		net: packet: fix wrong transport_header when sending VLAN-tagged frame
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01fdecc0480d916c799dbee584833a4a37e94d06 https://git.kernel.org/stable/c/5479eb9b355f44745d7ccfe112386bd4f96eceea https://git.kernel.org/stable/c/6386a6ffa2efba2965ed8e4fa303582c0b76a215 https://git.kernel.org/stable/c/6971cf319263d6a1b4096f9248aca9e57d77a1eb https://git.kernel.org/stable/c/a4b82de96d465ddb44bc931145c0fa80c4fe9c9c https://git.kernel.org/stable/c/e451e20adb869a983a21dda158625f024142e61f https://git.kernel.org/stable/c/f9297abbcaba760b7a7b9d63b839f607f738013e https://git.kernel.org/stable/c/fa86bc52ea8ba981f74f851fd61e2a3d3bc0feac

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T17:19:16.531Z

Updated: 2026-09-04T17:19:16.531Z

Reserved: 2026-08-26T14:34:25.800Z

Link: CVE-2026-80906

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T18:18:00.240

Modified: 2026-09-04T18:18:00.240

Link: CVE-2026-80906

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T22:00:05Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object