CVE-2026-80905 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
net: tap: fix wrong transport_header when sending VLAN-tagged frame
In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header.
In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U).
Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability in question resides within the Linux kernel's TAP (Tunnel Access Point) driver subsystem, specifically affecting the handling of Virtual LAN tagged frames during XDP (eXpress Data Path) processing. The core technical flaw is a logic error regarding the order of operations when setting network and transport headers for incoming packets that contain VLAN tags. When a packet arrives with an Ethernet type indicating it carries a VLAN tag, such as ETH_P_8021Q, the function tap_get_user_xdp incorrectly advances the network header pointer past the VLAN tag before probing for the transport layer information. This premature adjustment causes subsequent parsing functions to misinterpret the packet structure because they expect the network header to point at the outermost protocol boundary rather than an inner encapsulated one.
The operational impact of this flaw manifests as a failure in flow dissection and connection tracking, which can lead to dropped packets or incorrect routing decisions within virtualized networking environments. Specifically, when skb_probe_transport_header is invoked with the network header already advanced past the VLAN tag, it calculates nhoff based on that incorrect offset. The kernel's packet dissector then attempts to parse a struct vlan_hdr at this location, but since the pointer actually targets an inner protocol header like IP or TCP, the data read does not conform to the expected VLAN header structure. This results in the extraction of garbage encapsulated EtherType values that do not match any known protocols. Consequently, the flow dissector returns false, preventing the subsequent call to skb_set_transport_header from executing properly.
This sequence leaves the transport_header field at its uninitialized sentinel value, typically represented as ~0U or a similar invalid marker indicating no valid transport header was found. In practical terms, this means that any network stack components relying on accurate layer 4 information for stateful inspection, load balancing, or security policy enforcement will fail to process these packets correctly. For systems heavily reliant on TAP interfaces and XDP acceleration, such as cloud infrastructure providers running virtual machines with VLAN tagging enabled, this bug can cause intermittent connectivity issues or complete loss of traffic for specific flows that utilize VLAN encapsulation.
The resolution involves correcting the sequence of header pointer adjustments by moving the call to skb_set_network_header to occur after skb_probe_transport_header has completed its analysis. By ensuring that network_header initially points to the start of the Ethernet frame, including the VLAN tag, nhoff is calculated correctly relative to the outermost protocol boundary. This allows the flow dissector to properly parse the actual VLAN header, extract the correct inner EtherType, and advance nhoff appropriately before any transport layer headers are identified or set. This fix ensures that both network and transport headers accurately reflect the packet's true structure from the outside in, enabling proper dissection and processing by downstream kernel subsystems.
From a classification perspective, this vulnerability aligns with CWE-841, Improper Enforcement of Behavioral Workflow, as the code fails to enforce the correct logical sequence required for parsing encapsulated network protocols. It also relates to CWE-20, Improper Input Validation, insofar as the packet structure is not validated against expected header boundaries before pointer arithmetic is applied. In terms of MITRE ATT&CK mapping, while this is primarily a stability and correctness issue rather than an exploit vector, it impacts Availability by potentially causing service disruption for affected network flows through dropped or misrouted packets.
Mitigation strategies involve applying the kernel patch that reorders these header setting operations to ensure proper VLAN tag parsing precedence. Administrators should monitor their systems for signs of unexplained packet drops on TAP interfaces associated with virtual machines using VLAN tagging, particularly in environments where XDP is actively utilized for performance optimization. Keeping the Linux kernel updated to versions containing this fix is essential for maintaining reliable network connectivity and ensuring that security tools relying on accurate flow metadata continue to function as intended without false negatives due to malformed header pointers.