CVE-2026-80906: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80906 is a Linux kernel vulnerability in the packet processing subsystem that causes an uninitialized transport_header when sending VLAN-tagged frames. The flaw exists in packet_parse_headers(), where incorrect sequencing of skb_set_network_header() and skb_probe_transport_header() causes the flow dissector to misparse packet headers, leaving transport_header at its uninitialized sentinel value (~0U). Affected kernel versions include stable branches from 5.4.229 through ranges prior to 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, and 7.1.10, as well as kernel 5.19. The vulnerability was published on September 4, 2026, with a CVSS category estimate of Medium (GitHub Advisory).

The root cause is an incorrect ordering of function calls in packet_parse_headers() within the Linux kernel's net/packet subsystem. When a VLAN-tagged frame is processed, skb_set_network_header() advances network_header past the VLAN tag before skb_probe_transport_header() is called. At that point, skb->protocol is still set to the outer VLAN EtherType (ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points to the inner protocol header (e.g., an IP header). The flow dissector in __skb_flow_dissect() then attempts to read a struct vlan_hdr at the wrong offset, misinterpreting the inner IP header bytes as a VLAN header, yielding a garbage EtherType. Because no known protocol matches, the dissector returns false and skb_set_transport_header() is never called, leaving transport_header uninitialized. The fix reorders the call so skb_probe_transport_header() executes before skb_set_network_header(), allowing the dissector to correctly parse the VLAN header and set transport_header (GitHub Advisory).

Exploitation of this vulnerability can result in packet processing failures, incorrect packet routing, or kernel crashes (Denial of Service) when the uninitialized transport_header value (~0U) is subsequently dereferenced by kernel code. Any local user or remote network entity capable of sending VLAN-tagged frames through an affected system can trigger this condition. The primary impact is availability, with no direct confidentiality or integrity compromise reported (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported. The attack requires the ability to send VLAN-tagged frames to or through an affected system, which may be achievable by local users or network-adjacent attackers depending on the environment.

Update the Linux kernel to a fixed version: 5.10.266 or later (5.10.x branch), 5.15.217 or later (5.15.x branch), 6.1.184 or later (6.1.x branch), 6.6.153 or later (6.6.x branch), 6.12.105 or later (6.12.x branch), 6.18.46 or later (6.18.x branch), or 7.1.10 or later (7.1.x branch). The fix is also present in kernel 7.2 and later. Patches are available via the stable kernel git tree at multiple commits including a4b82de96d46, fa86bc52ea8b, 5479eb9b355f, e451e20adb86, 6971cf319263, f9297abbcaba, 6386a6ffa2ef, and 01fdecc0480d. Prioritize patching systems that process VLAN-tagged network traffic (GitHub Advisory).