Answer in brief
CVE-2026-80905 records a Unknown severity vulnerability in net: tap: fix wrong transport_header when sending VLAN-tagged frame. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8c76e77f9069f10505c08e02646c3ee11ad79038 <5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b || >=8c76e77f9069f10505c08e02646c3ee11ad79038 <88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3 || >=8c76e77f9069f10505c08e02646c3ee11ad79038 <cbb35cbe8db268fefe34c23df15348cf99025298 || 3cae5ef1f37a475faf7c40bc6a3c170779f3e0b1 || >=4.20.1 <4.21 | 5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b, 88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3, cbb35cbe8db268fefe34c23df15348cf99025298, 4.21 |
| Linux/Linuxgeneric | 5.0 | Not reported |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_header() is called first to advance network_header past the VLAN tag to the inner protocol header. skb_probe_transport_header() is then called with skb->protocol still set to ETH_P_8021Q, while nhoff (derived from skb_network_offset()) already points past the VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at the current nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skb_probe_transport_header() never calls skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move skb_set_network_header() to after skb_probe_transport_header(). At the time skb_probe_transport_header() is called, network_header still points to the VLAN header (offset ETH_HLEN), so nhoff is correct and the flow dissector can parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transport_header to be set correctly.
Quoted source text, attributed separately from HOL analysis.