CVE-2026-80731

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Published Sep 3, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

dev_validate_header() reads dev->hard_header_len directly when
zero-padding short link layer headers for CAP_SYS_RAWIO holders:

if (capable(CAP_SYS_RAWIO)) {
memset(ll_header + len, 0, dev->hard_header_len - len);
return true;
}

Packet send paths call dev_validate_header() on skbs whose headroom was
allocated from an earlier hard_header_len read. If the device is
reconfigured so that dev->hard_header_len increases before validation,
the memset writes past the reserved buffer, an out-of-bounds write.

This out-of-bounds write is masked in some SOCK_RAW paths today because
the same concurrent increase can first make skb_push() exceed the
reserved headroom and trigger skb_under_panic(). Remove the zero-padding
branch before making those hard_header_len reads consistent, so the
snapshot fixes do not turn a loud panic into a silent overwrite.

This path is only reached for variable length L2 protocols, where
len < hard_header_len but len >= min_header_len. No remaining in-tree
variable length L2 protocol implements header_ops->validate, and the
CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
real value beyond allowing testing of intentionally malformed input.

Drop the CAP_SYS_RAWIO branch. The remaining reads of
dev->hard_header_len in dev_validate_header() are comparisons only and
have no memory safety impact.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b5518429e70cd783b8ca52335456172c1a0589f6`	affected	< 53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 8fc9816404166a90ed8d544dc52482fafffb6d9f
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< b0f92a5731dc82556a9ae005cc35f71ab136307b
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 99df6b7a713f96eda206680d100b76e15f9d9b69
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 74e035f07f53feca09e2352e77fccb09cad5e208
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< dbb30dc943a93e083f1e531bfdc6779e57de40d0
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< fc902f52a02298c7432b2334c0c82a2885a1a8b6
`2793a23aacbd754dbbb5cb75093deb7e4103bace`	affected	< 3b9a324e646d3657a8d9806dfbfe4f3e4066e882
`f58a6c08ebdfa978178bbca78c2ba744a2665912`	affected	—
`1df16498dfd0d5a129bdf2982d9a08df73e8923d`	affected	—
`8b8d278aa4de9335682bbd4a3bb619af015c859e`	affected	—
`6804052fa9d86e9a512c88b24a5debbfc1a490fc`	affected	—
`3.2.80`	affected	< 3.2.81
`3.16.36`	affected	< 3.17
`4.1.28`	affected	< 4.2
`4.4.8`	affected	< 4.5
`4.5.2`	affected	< 4.6

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`3.2.81`	unaffected	≤ 3.2.*
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[b5518429e70cd783b8ca52335456172c1a0589f6,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[2793a23aacbd754dbbb5cb75093deb7e4103bace,53fd7f912c0877647d6a1e1877f5ea8535ee0b4a)`	affected	code_commit	—
`[f58a6c08ebdfa978178bbca78c2ba744a2665912,*]`	affected	code_commit	—
`[1df16498dfd0d5a129bdf2982d9a08df73e8923d,*]`	affected	code_commit	—
`[8b8d278aa4de9335682bbd4a3bb619af015c859e,*]`	affected	code_commit	—
`[6804052fa9d86e9a512c88b24a5debbfc1a490fc,*]`	affected	code_commit	—
`[3.2.80,3.2.81)`	affected	semver	—
`[3.16.36,3.17)`	affected	generic	—
`[4.1.28,4.2)`	affected	generic	—
`[4.4.8,4.5)`	affected	generic	—
`[4.5.2,4.6)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4.6,4.6]`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[3.2.81,3.2.*]`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.152,6.6.*]`	unaffected	generic	—
`[6.12.104,6.12.*]`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.142% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882
https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a
https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208
https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f
https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69
https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b
https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0
https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6
https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 4, 2026 8:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sep 4, 2026 6:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-120 CWE-122

Sep 4, 2026 5:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 3, 2026 12:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-122

Sep 3, 2026 7:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
Title		net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882 https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208 https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69 https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0 https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6 https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6