CVE-2026-80731: Schwachstellen-Eintrag (NVD)
In the Linux kernel, the following vulnerability has been resolved:
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:
if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}
Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.
This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.
This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.
Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.
- 🔗 git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e…
- 🔗 git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea85…
- 🔗 git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09…
- 🔗 git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fa…
- 🔗 git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e1…
- 🔗 git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71a…
- 🔗 git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e…
- 🔗 git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2…
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-29 | 2026-09-06 |
|---|---|---|
| ≥90 % | 4 | 0 |
| ≥50 % | 4 | 0 |
| ≥10 % | 3 | 0 |
| <10 % | 304 | 300 |
CVE-2026-80731 | Linux Kernel up to 7.1.8 Net Header Validation dev_validate_header hard_header_len out-of-bounds write (Nessus ID 342723)
A vulnerability classified as very critical was found in Linux Kernel up to 7.1.8. The impacted element is the function dev_validate_header of the component Net Header Validation. The manipulation of the argument hard_header_len results in