{"id":3394,"date":"2026-09-04T04:59:41","date_gmt":"2026-09-03T20:59:41","guid":{"rendered":"https:\/\/www.54iter.cn\/?p=3394"},"modified":"2026-09-04T04:59:41","modified_gmt":"2026-09-03T20:59:41","slug":"cve-2026-80742","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80742","title":{"rendered":"CVE-2026-80742 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: Don&#8217;t send"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>af_packet: Don&#8217;t send zero-byte data in tpacket_snd().<\/p>\n<p>syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():<\/p>\n<p>skb_assert_len<br \/>\nWARNING: at include\/linux\/skbuff.h:2753 skb_assert_len<br \/>\nWARNING: at __dev_queue_xmit+0x21bc\/0x4970 net\/core\/dev.c:4781<\/p>\n<p>Call Trace:<\/p>\n<p> dev_queue_xmit include\/linux\/netdevice.h:3448 [inline]<br \/>\n packet_xmit+0x243\/0x310 net\/packet\/af_packet.c:276<br \/>\n tpacket_snd net\/packet\/af_packet.c:2907 [inline]<br \/>\n packet_sendmsg+0x28d6\/0x4eb0 net\/packet\/af_packet.c:3134<\/p>\n<p>When sending 0-byte packets via TPACKET ring buffer on devices with no<br \/>\nhard header (e.g. dev-&gt;hard_header_len == 0), tpacket_fill_skb()<br \/>\npopulates an skb with skb-&gt;len == 0 and returns 0. tpacket_snd() then<br \/>\nforwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to<br \/>\nhit skb_assert_len(skb).<\/p>\n<p>Similar checks exist in packet_snd() via commit dc633700f00f<br \/>\n(&#8220;net\/af_packet: check len when min_header_len equals to 0&#8221;) and in<br \/>\npacket_sendmsg_spkt() via commit 6a341729fb31 (&#8220;af_packet: Don&#8217;t send<br \/>\nzero-byte data in packet_sendmsg_spkt().&#8221;).<\/p>\n<p>Return -EINVAL in tpacket_fill_skb() when skb-&gt;len is zero to reject<br \/>\nzero-length packets in tpacket_snd().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>af_packet: Don&#8217;t send zero-byte data in tpacket_snd().<\/p>\n<p>syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-3394","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/3394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}