CVE-2026-80905: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80905 is a Linux kernel vulnerability in the TAP interface's VLAN-tagged frame processing that can result in an uninitialized transport header, potentially causing kernel crashes or network failures. The flaw exists in the tap_get_user_xdp() function and affects Linux kernel versions from 4.20.1 up to (but not including) 4.21, as well as kernel 5.0 through versions prior to the fixes in stable branches (patched at commits 5ffaa5d, 88b79ac, and cbb35cb). It was published on September 4, 2026. The CVSS category is estimated as HIGH by Feedly (GitHub Advisory, Feedly).

The root cause is an incorrect ordering of skb_set_network_header() and skb_probe_transport_header() calls within tap_get_user_xdp() in the Linux kernel's TAP driver. When a VLAN-tagged frame (ETH_P_8021Q) is processed, skb_set_network_header() is called first, advancing network_header past the VLAN tag to the inner protocol header. When skb_probe_transport_header() subsequently invokes __skb_flow_dissect(), the flow dissector sees proto = ETH_P_8021Q but nhoff already pointing past the VLAN tag; it then reads the inner protocol header bytes (e.g., an IP header) as if they were a struct vlan_hdr, producing a garbage EtherType. Because no known protocol matches, the dissector returns false and skb_set_transport_header() is never called, leaving transport_header at its uninitialized sentinel value (~0U). The fix moves skb_set_network_header() to after skb_probe_transport_header(), ensuring the flow dissector operates on the correct offsets (GitHub Advisory).

A local user with privileges to create or manage TAP interfaces can send specially crafted VLAN-tagged frames that trigger malformed socket buffer (skb) processing, leaving the transport header uninitialized. This can result in a kernel panic or crash (denial of service), as well as incorrect network packet handling that may disrupt network functionality on the affected host. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise beyond the local system (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. Exploitation requires local access to a system with the ability to create or manage TAP interfaces, limiting the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution has been reported (Feedly, GitHub Advisory).

Apply the upstream kernel patches that correct the ordering of skb_set_network_header() and skb_probe_transport_header() in tap_get_user_xdp(). Fixes are available at stable commits 5ffaa5d7f56ab24a8e23cf131eadfef31a3bbc4b, 88b79ac89ecc04d7f2613f7e1c0b46f0c4ddb2f3, and cbb35cbe8db268fefe34c23df15348cf99025298; unpatched versions in the 6.18.x branch are fixed at 6.18.46, and in the 7.1.x branch at 7.1.10. As a workaround, restrict access to TAP interface creation and management to trusted, privileged users only to reduce exposure (GitHub Advisory, Kernel Stable).