CVE-2026-80731net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b5518429e70cd783b8ca52335456172c1a0589f6 before 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a; from 2793a23aacbd754dbbb5cb75093deb7e4103bace before fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6; 2793a23aacbd754dbbb5cb75093deb7e4103bace builds before 8fc9816404166a90ed8d544dc52482fafffb6d9f; from 2793a23aacbd754dbbb5cb75093deb7e4103bace before b0f92a5731dc82556a9ae005cc35f71ab136307b; 2793a23aacbd754dbbb5cb75093deb7e4103bace builds before 99df6b7a713f96eda206680d100b76e15f9d9b69; 2793a23aacbd754dbbb5cb75093deb7e4103bace builds before 74e035f07f53feca09e2352e77fccb09cad5e208; from 2793a23aacbd754dbbb5cb75093deb7e4103bace before dbb30dc943a93e083f1e531bfdc6779e57de40d0; from 2793a23aacbd754dbbb5cb75093deb7e4103bace before fc902f52a02298c7432b2334c0c82a2885a1a8b6; and 10 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
- https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
- https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f
- https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b
- https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69
- https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208
- https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0
- https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6
- https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.