CVE-2026-80925

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vlan: fix skb_under_panic and races when toggling HW VLAN offload<br /> <br /> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or<br /> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),<br /> which dynamically changed vlandev-&gt;hard_header_len.<br /> <br /> This causes two issues:<br /> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)<br /> read dev-&gt;hard_header_len without holding RTNL lock. Mutating<br /> hard_header_len dynamically under RTNL creates a data race where upper<br /> layers reserve insufficient headroom based on a stale hard_header_len,<br /> resulting in skb_under_panic when vlan_dev_hard_header() is called.<br /> 2. In addition, vlan_transfer_features() updated hard_header_len without<br /> updating header_ops, causing a mismatch between allocated headroom<br /> and header creation.<br /> <br /> Always setting dev-&gt;hard_header_len = real_dev-&gt;hard_header_len and<br /> dev-&gt;needed_headroom = real_dev-&gt;needed_headroom + VLAN_HLEN unconditionally<br /> ensures:<br /> - dev-&gt;hard_header_len remains 100% static and immutable at real_dev-&gt;hard_header_len,<br /> eliminating all dynamic runtime updates and data races on hard_header_len.<br /> - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve<br /> sufficient headroom for software VLAN tag insertion (real_dev-&gt;hard_header_len +<br /> real_dev-&gt;needed_headroom + VLAN_HLEN).<br /> - vlandev inherits real_dev-&gt;needed_tailroom so underlying trailer/padding/ICV<br /> requirements are honored.<br /> - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at<br /> real_dev-&gt;hard_header_len.<br /> - vlan_header_ops is used unconditionally.<br /> <br /> Note to stable teams: Make sure to backport these commits:<br /> <br /> e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")<br /> cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")