The Linux kernel's tap driver had a flaw where tap_get_user_xdp() parsed the virtio-net header before assigning skb->dev. Since virtio_net_hdr_to_skb() can call dev_parse_header_protocol(), which dereferences skb->dev, this could lead to a NULL pointer dereference and kernel crash if skb->dev was still NULL. The fix involved assigning skb->dev before parsing the header, consistent with the approach in tap_get_user(), preventing the crash triggered by crafted virtio-net headers with protocol zero.

A NULL pointer dereference vulnerability could cause the Linux kernel to crash when processing specific virtio-net headers in the tap driver. This results in a denial of service condition affecting systems using the tap network interface. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to assign skb->dev before parsing the virtio-net header in tap_get_user_xdp(), preventing the NULL pointer dereference. Users should apply the official kernel update containing this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or kernel release notes for the exact fixed version and update accordingly.