CVE-2026-80841

A flaw was found in the Linux kernel's net/packet component, specifically within the AF_PACKET transmission ring. This vulnerability occurs because virtual memory allocated for network packet handling is prematurely released while active network buffers (socket kernel buffers, or skbs) still hold references to it. This improper memory management can lead to memory corruption, potentially allowing a local attacker to cause a system crash (Denial of Service).

An IMPORTANT severity flaw was found in the Linux kernel's AF_PACKET (net/packet) TX_RING implementation, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS 2, and the affected OpenShift streams. When a vmalloc-backed transmission ring is freed on socket close or replaced while transmitted skbs are still pending, those skbs can still hold raw pointers to their ring frames, because skb page references preserve page-backed ring blocks but not vmalloc mappings. A local attacker able to use AF_PACKET sockets could race ring teardown against pending transmissions to trigger kernel memory corruption, resulting in a system crash or denial of service. Red Hat rated this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the high attack complexity reflects the race-condition window required for reliable exploitation. Because the affected product streams are delegated, fixes are being pursued by the respective product teams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.