{"id":17485,"date":"2026-09-05T02:31:10","date_gmt":"2026-09-04T18:31:10","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80905"},"modified":"2026-09-05T02:31:10","modified_gmt":"2026-09-04T18:31:10","slug":"cve-2026-80905","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80905","title":{"rendered":"CVE-2026-80905 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tap: fix wrong t"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: tap: fix wrong transport_header when sending VLAN-tagged frame<\/p>\n<p>In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g.<br \/>\nETH_P_8021Q), skb_set_network_header() is called first to advance<br \/>\nnetwork_header past the VLAN tag to the inner protocol header.<br \/>\nskb_probe_transport_header() is then called with skb-&gt;protocol still<br \/>\nset to ETH_P_8021Q, while nhoff (derived from skb_network_offset())<br \/>\nalready points past the VLAN tag to the inner protocol header.<\/p>\n<p>In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and nhoff<br \/>\npoints past the VLAN tag. When the dissector hits case ETH_P_8021Q, it<br \/>\nreads a struct vlan_hdr at the current nhoff via __skb_header_pointer(),<br \/>\nbut that offset contains the inner protocol header (e.g. an IP header).<br \/>\nThe bytes are misinterpreted as a VLAN header, yielding a garbage<br \/>\nencapsulated EtherType that matches no known protocol. The dissector<br \/>\nreturns false, so skb_probe_transport_header() never calls<br \/>\nskb_set_transport_header(), leaving transport_header at its uninitialized<br \/>\nsentinel value (~0U).<\/p>\n<p>Move skb_set_network_header() to after skb_probe_transport_header(). At<br \/>\nthe time skb_probe_transport_header() is called, network_header still<br \/>\npoints to the VLAN header (offset ETH_HLEN), so nhoff is correct and the<br \/>\nflow dissector can parse the VLAN header, extract the inner EtherType,<br \/>\nand advance nhoff to the inner protocol header, allowing transport_header<br \/>\nto be set correctly.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: tap: fix wrong transport_header when sending VLAN-tagged frame<\/p>\n<p>In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}