CVE-2026-80925

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vlan: fix skb_under_panic and races when toggling HW VLAN offload

Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or

NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),

which dynamically changed vlandev->hard_header_len.

This causes two issues:

1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)

read dev->hard_header_len without holding RTNL lock. Mutating

hard_header_len dynamically under RTNL creates a data race where upper

layers reserve insufficient headroom based on a stale hard_header_len,

resulting in skb_under_panic when vlan_dev_hard_header() is called.

2. In addition, vlan_transfer_features() updated hard_header_len without

updating header_ops, causing a mismatch between allocated headroom

and header creation.

Always setting dev->hard_header_len = real_dev->hard_header_len and

dev->needed_headroom = real_dev->needed_headroom + VLA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References