CVE-2026-80905

A flaw was found in the kernel. When processing VLAN-tagged frames, the network header is incorrectly advanced past the VLAN tag before the transport header is probed. This misinterprets the inner protocol header as a VLAN header, resulting in an uninitialized transport header. This issue can lead to incorrect packet dissection and potentially affect network functionality.

A VLAN tagged frame sent through the TAP transmit path can leave skb transport_header unset because skb_probe_transport_header is called after network_header has already been advanced past the VLAN header. The flow dissector then interprets the inner protocol header as a VLAN header, fails to identify the real transport offset, and the skb may continue through dev_queue_xmit with a sentinel transport_header value. For the CVSS the PR:N is used in the paranoid interpretation because a malicious guest or adjacent virtual network peer may be able to provide VLAN tagged frames to an already configured TAP path without host administrative privileges. The issue is not directly Internet reachable in normal deployments because TAP is a local or virtual network device path. Impact is most likely denial of service or incorrect packet metadata handling, with limited integrity impact possible if later packet processing depends on the wrong transport header.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.