CVE-2026-80742

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_packet: Don't send zero-byte data in tpacket_snd().

syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():

skb_assert_len

WARNING: at include/linux/skbuff.h:2753 skb_assert_len

WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781

Call Trace:

<TASK>

dev_queue_xmit include/linux/netdevice.h:3448 [inline]

packet_xmit+0x243/0x310 net/packet/af_packet.c:276

tpacket_snd net/packet/af_packet.c:2907 [inline]

packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134

When sending 0-byte packets via TPACKET ring buffer on devices with no

hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()

populates an skb with skb->len == 0 and returns 0. tpacket_snd() then

forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to

hit skb_assert_len(skb).

Similar checks exist in packet_snd() via commit dc633700f00f

("net/af_packet: check len when min_header_len equals to 0")

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References