CVE-2026-80925: Linux kernel · vlan: fix skb_under_panic and races when toggling HW VLAN offload
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 14:05 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 9 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The vulnerability has been resolved by a patch that makes dev->hard_header_len static and immutable, and correctly inherits needed_headroom and needed_tailroom from the underlying device. Users should apply the official kernel updates that include these fixes. Stable kernel teams are advised to backport the relevant commits (e16e960d55a4 and cef51860becd). No additional mitigation is required once the patch is applied.
Description
A vulnerability in the Linux kernel's VLAN implementation caused data races and incorrect buffer headroom allocation when toggling hardware VLAN TX offload features. This could lead to kernel panics due to insufficient headroom reserved for VLAN tags. The issue was fixed by making the hard_header_len static and ensuring consistent headroom and tailroom inheritance from the underlying device.
References
- ubuntu.com/security/CVE-2026-80925 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-80925 (opens in a new tab)
- git.kernel.org/linus/447cbe95ebb95392b5d8f6a01c0556826919ce23 (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-80925 (opens in a new tab)
- git.kernel.org/stable/c/1517d1996b5236fe69eccd9d253f725e06996eb1 (opens in a new tab)
- git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23 (opens in a new tab)
- git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07 (opens in a new tab)
- git.kernel.org/stable/c/b30fe4de285b9bdaf9508740191f69f7cd83b8fa (opens in a new tab)
- git.kernel.org/stable/c/b38d7a4bc9c17e1d437696da25f9fbc286614d9d (opens in a new tab)