CVE-2026-80925

A flaw was found in the Linux kernel's VLAN module. When hardware VLAN TX offload is enabled or disabled, it can lead to timing issues, known as data races, where different parts of the system access and modify shared data concurrently without proper synchronization. This can cause the system to reserve insufficient space for network packet headers, leading to a system crash (kernel panic) and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux and OpenShift environments because triggering the race condition requires administrative privileges (specifically CAP_NET_ADMIN) to toggle hardware VLAN offload features on an underlying interface, and the resulting impact is confined to a local denial of service via a kernel panic. Standard deployments configure network interface offloading at boot or device initialization, making dynamic runtime toggling under concurrent packet transmission uncommon in production workloads. Unprivileged users cannot directly modify interface offload parameters to induce this crash without a privileged administrator or orchestration service concurrently reconfiguring the network device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.