CVE-2026-80841

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: defer vmalloc TX_RING free until skbs finish

AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb

page references preserve page-backed ring blocks after pg_vec is freed,

but they do not preserve a vmalloc mapping.

tpacket_destruct_skb() currently drops the pending reference before

writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the

decrement after those stores. The smp_wmb() in __packet_set_status()

orders the frame stores before the decrement.

Also recheck pending TX frames under pg_vec_lock before non-closing

ring replacement, so a racing send cannot add a pending skb between

the initial check and the ring swap.

Ring allocation can produce a mixture of page-backed and vmalloc-backed

blocks. Allocate deferred-work storage during TX ring setup when the

first vmalloc-backed block is encountered, and keep its pointer in the

pg_vec allocation header. If allocation fails,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References