CVE-2026-80925: Linux kernel · vlan: fix skb_under_panic and races when toggling HW VLAN offload
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in b38d7a4bc9c17e1d437696da25f9fbc286614d9d : patch Linux kernel soon.
Data as of 30 Oct 2026, 13:06 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in b38d7a4bc9c17e1d437696da25f9fbc286614d9d, b30fe4de285b9bdaf9508740191f69f7cd83b8fa, a29f3b884ba50217e6f50414f568073221e2bb07 +3
Exploitation evidence
Disclosed: evidence found.
CVE published 9 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been committed to the Linux kernel. The patch makes dev->hard_header_len static and aligns headroom allocation to prevent data races and skb_under_panic. It is recommended to update to a Linux kernel version that includes the commits identified by hashes b38d7a4bc9c17e1d437696da25f9fbc286614d9d, b30fe4de285b9bdaf9508740191f69f7cd83b8fa, a29f3b884ba50217e6f50414f568073221e2bb07, 1517d1996b5236fe69eccd9d253f725e06996eb1, 447cbe95ebb95392b5d8f6a01c0556826919ce23, and 69f2fc6e761ee68a4c0c8e416ae88c573d4d7319. Stable kernel maintainers should backport these fixes to affected versions. No additional mitigations are indicated.
Description
A vulnerability in the Linux kernel's VLAN implementation causes data races and incorrect memory headroom allocation when toggling hardware VLAN TX offload features. This can lead to skb_under_panic errors due to stale hard_header_len values being used in lockless transmit paths. The issue arises from dynamic updates to dev->hard_header_len without proper synchronization and mismatches between allocated headroom and header creation. The fix ensures dev->hard_header_len remains static and aligns headroom allocation correctly, eliminating the race conditions and preventing skb_under_panic.
References
- git.kernel.org/stable/c/69f2fc6e761ee68a4c0c8e416ae88c573d4d7319 (opens in a new tab)
- git.kernel.org/stable/c/b38d7a4bc9c17e1d437696da25f9fbc286614d9d (opens in a new tab)
- git.kernel.org/stable/c/b30fe4de285b9bdaf9508740191f69f7cd83b8fa (opens in a new tab)
- git.kernel.org/stable/c/1517d1996b5236fe69eccd9d253f725e06996eb1 (opens in a new tab)
- git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07 (opens in a new tab)
- git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23 (opens in a new tab)