CVE-2026-80731

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

dev_validate_header() reads dev->hard_header_len directly when

zero-padding short link layer headers for CAP_SYS_RAWIO holders:

if (capable(CAP_SYS_RAWIO)) {

memset(ll_header + len, 0, dev->hard_header_len - len);

return true;

}

Packet send paths call dev_validate_header() on skbs whose headroom was

allocated from an earlier hard_header_len read. If the device is

reconfigured so that dev->hard_header_len increases before validation,

the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK_RAW paths today because

the same concurrent increase can first make skb_push() exceed the

reserved headroom and trigger skb_under_panic(). Remove the zero-padding

branch before making those hard_header_len reads consistent, so the

snapshot fixes do not turn a loud panic into a silent ove

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References