Skip to main content
VulnerabilityPublished Updated

CVE-2026-80925: Linux kernel · vlan: fix skb_under_panic and races when toggling HW VLAN offload

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in b38d7a4bc9c17e1d437696da25f9fbc286614d9d : patch Linux kernel soon.

Data as of 30 Oct 2026, 13:06 UTC

Severity
High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none
Patch
Available – fixed in b38d7a4bc9c17e1d437696da25f9fbc286614d9d, b30fe4de285b9bdaf9508740191f69f7cd83b8fa, a29f3b884ba50217e6f50414f568073221e2bb07 +3

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 9 Sep 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b38d7a4bc9c17e1d437696da25f9fbc286614d9d
Fixed in
  • b38d7a4bc9c17e1d437696da25f9fbc286614d9d
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b30fe4de285b9bdaf9508740191f69f7cd83b8fa
Fixed in
  • b30fe4de285b9bdaf9508740191f69f7cd83b8fa
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a29f3b884ba50217e6f50414f568073221e2bb07
Fixed in
  • a29f3b884ba50217e6f50414f568073221e2bb07
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1517d1996b5236fe69eccd9d253f725e06996eb1
Fixed in
  • 1517d1996b5236fe69eccd9d253f725e06996eb1
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 447cbe95ebb95392b5d8f6a01c0556826919ce23
Fixed in
  • 447cbe95ebb95392b5d8f6a01c0556826919ce23
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 69f2fc6e761ee68a4c0c8e416ae88c573d4d7319
Fixed in
  • 69f2fc6e761ee68a4c0c8e416ae88c573d4d7319

AI-suggested

A fix is available and has been committed to the Linux kernel. The patch makes dev->hard_header_len static and aligns headroom allocation to prevent data races and skb_under_panic. It is recommended to update to a Linux kernel version that includes the commits identified by hashes b38d7a4bc9c17e1d437696da25f9fbc286614d9d, b30fe4de285b9bdaf9508740191f69f7cd83b8fa, a29f3b884ba50217e6f50414f568073221e2bb07, 1517d1996b5236fe69eccd9d253f725e06996eb1, 447cbe95ebb95392b5d8f6a01c0556826919ce23, and 69f2fc6e761ee68a4c0c8e416ae88c573d4d7319. Stable kernel maintainers should backport these fixes to affected versions. No additional mitigations are indicated.

Description

A vulnerability in the Linux kernel's VLAN implementation causes data races and incorrect memory headroom allocation when toggling hardware VLAN TX offload features. This can lead to skb_under_panic errors due to stale hard_header_len values being used in lockless transmit paths. The issue arises from dynamic updates to dev->hard_header_len without proper synchronization and mismatches between allocated headroom and header creation. The fix ensures dev->hard_header_len remains static and aligns headroom allocation correctly, eliminating the race conditions and preventing skb_under_panic.

References

Community reviews

Loading reviews…