---
cve: "CVE-2026-80731"
severity: "HIGH"
cvss: 7.8
epss: "32.3%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-03 13:06:11"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T05:23:24+02:00"
---

# CVE-2026-80731

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:

    if (capable(CAP_SYS_RAWIO)) {
        memset(ll_header + len, 0, dev->hard_header_len - len);
        return true;
    }

Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.

This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.

Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 3.2.81
- Kernel ≥ 5.10.265
- Kernel ≥ 5.15.216
- Kernel ≥ 6.1.183
- Kernel ≥ 6.6.152
- Kernel ≥ 6.12.104
- Kernel ≥ 6.18.45
- Kernel ≥ 7.1.9

## Referenzen

- <https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882>
- <https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a>
- <https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208>
- <https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f>
- <https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69>
- <https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b>
- <https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0>
- <https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6>
- <https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80731) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_