Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80925— vlan: fix skb_under_panic and races when toggling HW VLAN offload

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已修复： vlan：修复在切换硬件 VLAN 卸载时出现的 和数据竞争问题 当在底层设备上切换硬件 VLAN TX 卸载功能（ 或 ）时，会调用 ，该函数会动态修改 。 这引发了以下两个问题： 1. 无锁 TX 路径（例如 中的 、 ）在未持有 RTNL 锁的情况下读取 。在 RTNL 锁保护下动态修改 会造成数据竞争：上层协议栈可能基于过时的 预留了不足的头部空间（headroom），导致在调用 时触发 。 2. 此外， 在更新 时未同步更新 ，导致预留的头部空间与实际头部生成之间

AI Predicted 3.1 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a29f3b884ba50217e6f50414f568073221e2bb07 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 447cbe95ebb95392b5d8f6a01c0556826919ce23 affected
2.6.12 affected
< 2.6.12 unaffected
7.2.3≤ 7.2.* unaffected
7.3-rc1≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80925

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vlan: fix skb_under_panic and races when toggling HW VLAN offload
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed vlandev->hard_header_len. This causes two issues: 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called. 2. In addition, vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between allocated headroom and header creation. Always setting dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures: - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all dynamic runtime updates and data races on hard_header_len. - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len + real_dev->needed_headroom + VLAN_HLEN). - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV requirements are honored. - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at real_dev->hard_header_len. - vlan_header_ops is used unconditionally. Note to stable teams: Make sure to backport these commits: e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ a29f3b884ba50217e6f50414f568073221e2bb07 -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-80925

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80925

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80925 (2)

Same Patch Batch · Linux · 2026-09-09 · 12 CVEs total

CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers
CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure
CVE-2026-80922 crypto: qcom-rng - Allow zero as a random number
CVE-2026-80921 KVM: s390: vsie: zero stale crypto bits
CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
CVE-2026-80919 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
CVE-2026-80918 HID: core: fix number/pointer type confusion on long items
CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
CVE-2026-80916 kcov: fix data corruption and race conditions on PREEMPT_RT
CVE-2026-80915 drm/xe: Fix DPT allocation paths.
CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80925

No comments yet

Leave a comment