CVE-2026-80731

A flaw was found in the Linux kernel's networking subsystem. A local user with CAP_SYS_RAWIO capabilities could trigger an out-of-bounds write in the dev_validate_header() function. This vulnerability arises if a device's header length increases concurrently during packet processing, causing a memory write to exceed its allocated buffer. Successful exploitation could lead to memory corruption.

dev_validate_header could zero pad a short link layer header using a later and larger dev hard_header_len than the value used when skb headroom was reserved. A concurrent device reconfiguration can therefore turn the CAP_SYS_RAWIO zero padding path into an out-of-bounds write past the reserved packet buffer. For the CVSS the PR:L is used in the paranoid score because CAP_SYS_RAWIO may be delegated to a reduced capability root or service account even though the normal base case is PR:H. The issue is local and is not directly network reachable because the trigger requires local packet send control and a timing race with device configuration changes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.