In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882 cve-icon cve-icon
https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a cve-icon cve-icon
https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208 cve-icon cve-icon
https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f cve-icon cve-icon
https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69 cve-icon cve-icon
https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b cve-icon cve-icon
https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0 cve-icon cve-icon
https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 cve-icon cve-icon
https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6 cve-icon cve-icon
History

Fri, 04 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 04 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-122

Fri, 04 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 03 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-122

Thu, 03 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
Title net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-03T08:21:48.924Z

Updated: 2026-09-04T04:58:17.510Z

Reserved: 2026-08-26T14:34:25.789Z

Link: CVE-2026-80731

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T13:06:11.707

Modified: 2026-09-04T05:17:13.583

Link: CVE-2026-80731

cve-icon Redhat

No data.