CVE-2026-80742: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80742 is a Linux kernel vulnerability in the af_packet subsystem where tpacket_snd() fails to reject zero-byte packets, triggering a kernel WARNING via skb_assert_len() in __dev_queue_xmit(). The flaw affects the Linux kernel from version 2.6.12 onward and was disclosed on September 3, 2026. Fixed versions include 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. Feedly estimates the severity as Medium, with an EPSS score of 0.0021 (Feedly, Linux CVE Announce).

The root cause is a missing input validation check (CWE-20) in tpacket_fill_skb() within net/packet/af_packet.c. When a user sends a 0-byte packet via the TPACKET ring buffer interface on a device with hard_header_len == 0, tpacket_fill_skb() returns an skb with skb->len == 0 without error, and tpacket_snd() forwards this empty skb to packet_xmit(), which causes __dev_queue_xmit() to hit the skb_assert_len() assertion and emit a kernel WARNING. Analogous checks already exist in packet_snd() (commit dc633700f00f) and packet_sendmsg_spkt() (commit 6a341729fb31), but were missing in the tpacket_snd() code path. The fix returns -EINVAL from tpacket_fill_skb() when skb->len is zero (Feedly, Linux CVE Announce).

Successful exploitation of this vulnerability by a local user with access to raw packet sockets can trigger a kernel WARNING, potentially causing system instability or denial of service. The impact is primarily an availability concern — the kernel assertion failure in __dev_queue_xmit() can disrupt network packet processing. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-80742. The vulnerability was originally discovered and reported by syzbot (Google's kernel fuzzer). The EPSS score is 0.0021 (approximately 0.21%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Update the Linux kernel to a patched version: 5.10.266 or later (5.10.x branch), 5.15.217 or later (5.15.x branch), 6.1.184 or later (6.1.x branch), 6.6.153 or later (6.6.x branch), 6.12.105 or later (6.12.x branch), 6.18.46 or later (6.18.x branch), 7.1.10 or later (7.1.x branch), or 7.2+. As a workaround where patching is not immediately possible, restricting unprivileged access to raw packet sockets (e.g., via CAP_NET_RAW capability controls or seccomp filtering) can reduce exposure. Oracle Linux users should apply the vendor-provided errata (ELSA-2026-500249) (Feedly, Linux CVE Announce).

The vulnerability was picked up by standard Linux security advisory channels including Oracle Linux errata and Tenable/Nessus plugin updates shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond routine CVE tracking (Feedly).