Look up another CVE · open CVE-2026-80731 in the interactive tracker
CVE-2026-80731
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Published 2026-09-03 (2 months ago) by the Linux kernel CNA. Subsystem include/linux. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80731 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/linux/netdevice.h
- What this is
- NETWORKING DRIVERSMAINTAINERS section matched on include/linux/netdev* · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-09-03 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 3.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/linux
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.2.80 | 3.2.81 | 53fd7f912c08 |
| 4.6 | 5.10.265 | fa6d98dd925e |
| 4.6 | 5.15.216 | 8fc981640416 |
| 4.6 | 6.1.183 | b0f92a5731dc |
| 4.6 | 6.6.152 | 99df6b7a713f |
| 4.6 | 6.12.104 | 74e035f07f53 |
| 4.6 | 6.18.45 | dbb30dc943a9 |
| 4.6 | 7.1.9 | fc902f52a022 |
| 4.6 | 7.2 | 3b9a324e646d |
| 3.16.36 | 0 | 0 |
| 4.1.28 | 0 | 0 |
| 4.4.8 | 0 | 0 |
| 4.5.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires a local sendmsg() on a PF_PACKET SOCK_RAW socket; dev_validate_header() is only reached from af_packet transmit paths (packet_snd, packet_sendmsg_spkt, tpacket_fill_skb), not from remote packet receive.
- AC:LAttack complexity, low
- The attacker can reliably win the TOCTOU race by concurrently sending PF_PACKET frames while changing netdev hard_header_len (e.g., PPP channel attach or bonding slave updates via rtnetlink), controlling both allocation and validation sides.
- PR:LPrivileges required, low
- PF_PACKET creation requires CAP_NET_RAW and the memset bypass requires CAP_SYS_RAWIO; both are granted to user-namespace root (CAP_FULL_SET via unshare -Urn), so a basic unprivileged local user can obtain the needed privileges without init-namespace root.
- UI:NUser interaction, none
- No victim interaction is required; exploitation is fully attacker-driven through socket creation, concurrent device reconfiguration, and crafted sendmsg() calls.
- S:UScope, unchanged
- Impact is kernel heap memory corruption and local privilege escalation within the same kernel security domain, not a VM escape, IOMMU bypass, or other cross-authority boundary violation.
- C:HConfidentiality impact, high
- The bug is an out-of-bounds write via memset() past skb link-layer headroom when hard_header_len grows between allocation and validation; such heap corruption can be groomed into arbitrary kernel memory read primitives.
- I:HIntegrity impact, high
- Writing past the reserved skb headroom corrupts adjacent kernel heap objects and is a standard exploitable primitive for arbitrary kernel writes, control-flow hijacking, and privilege escalation.
- A:HAvailability impact, high
- The out-of-bounds memset can corrupt critical kernel structures and trigger oops/panic; the commit notes this can silently overwrite memory where other SOCK_RAW paths would have panicked via skb_under_panic.