Homepage

CVE-2026-80925 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.16% (5th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LINUX612-20506998
  • published5 Oct 2026
  • disclosed9 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 9 Sep 2026

NewCVE-2026-80925  (opens in a new tab)

How to fix?

Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

vlan: fix skb_under_panic and races when toggling HW VLAN offload

Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed vlandev->hard_header_len.

This causes two issues:

  1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called.
  2. In addition, vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between allocated headroom and header creation.

Always setting dev->hard_header_len = real_dev->hard_header_len and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures:

  • dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all dynamic runtime updates and data races on hard_header_len.
  • Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len + real_dev->needed_headroom + VLAN_HLEN).
  • vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV requirements are honored.
  • AF_PACKET SOCK_RAW network header offsets remain correctly aligned at real_dev->hard_header_len.
  • vlan_header_ops is used unconditionally.

Note to stable teams: Make sure to backport these commits:

e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")