---
id: CVE-2026-80925
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vlan: fix skb_under_panic and races when toggling HW VLAN offload

  Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
  NETIF_F_HW_VLAN_STAG_TX) on a lower dev…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vlan: fix skb_under_panic and races when toggling HW VLAN offload

  Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
  NETIF_F_HW_VLAN_STAG_TX) on a lower dev…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b30fe4de285b9bdaf9508740191f69f7cd83b8fa
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    1517d1996b5236fe69eccd9d253f725e06996eb1
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a29f3b884ba50217e6f50414f568073221e2bb07
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    447cbe95ebb95392b5d8f6a01c0556826919ce23
  - Linux 2.6.12
published: '2026-09-09'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:21.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80925'
references:
  - url: 'https://git.kernel.org/stable/c/1517d1996b5236fe69eccd9d253f725e06996eb1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/447cbe95ebb95392b5d8f6a01c0556826919ce23'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a29f3b884ba50217e6f50414f568073221e2bb07'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b30fe4de285b9bdaf9508740191f69f7cd83b8fa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00156
epssPercentile: 0.05216
ingestedAt: '2026-09-11T16:45:47.924Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vlan: fix skb_under_panic and races when toggling HW VLAN offload

Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
which dynamically changed vlandev->hard_header_len.

This causes two issues:
1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
   read dev->hard_header_len without holding RTNL lock. Mutating
   hard_header_len dynamically under RTNL creates a data race where upper
   layers reserve insufficient headroom based on a stale hard_header_len,
   resulting in skb_under_panic when vlan_dev_hard_header() is called.
2. In addition, vlan_transfer_features() updated hard_header_len without
   updating header_ops, causing a mismatch between allocated headroom
   and header creation.

Always setting dev->hard_header_len = real_dev->hard_header_len and
dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
ensures:
- dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
  eliminating all dynamic runtime updates and data races on hard_header_len.
- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
  sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
  real_dev->needed_headroom + VLAN_HLEN).
- vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
  requirements are honored.
- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
  real_dev->hard_header_len.
- vlan_header_ops is used unconditionally.

Note to stable teams: Make sure to backport these commits:

e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.