CVE-2026-80742: af_packet: Don't send zero-byte data in tpacket_snd().

Published Sep 3, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

afpacket: Don't send zero-byte data in tpacketsnd().

syzbot reported a WARNING in devqueuexmit() triggered via tpacketsnd():

skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970 net/core/dev.c:4781

Call Trace: <TASK> devqueuexmit include/linux/netdevice.h:3448 [inline] packetxmit+0x243/0x310 net/packet/afpacket.c:276 tpacketsnd net/packet/afpacket.c:2907 [inline] packetsendmsg+0x28d6/0x4eb0 net/packet/afpacket.c:3134

When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hardheaderlen == 0), tpacketfillskb() populates an skb with skb->len == 0 and returns 0. tpacketsnd() then forwards this empty skb to packetxmit(), causing devqueuexmit() to hit skbassertlen(skb).

Similar checks exist in packetsnd() via commit dc633700f00f ("net/afpacket: check len when minheaderlen equals to 0") and in packetsendmsgspkt() via commit 6a341729fb31 ("afpacket: Don't send zero-byte data in packetsendmsgspkt().").

Return -EINVAL in tpacketfillskb() when skb->len is zero to reject zero-length packets in tpacketsnd().

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade net/packet/af_packet (Linux kernel) to a version that resolves this vulnerability.

    Patch dc633700f00f
  2. Upgrade

    Upgrade net/packet/af_packet (Linux kernel) to a version that resolves this vulnerability.

    Patch 6a341729fb31
  3. Configuration

    Implement the resolved behavior: in tpacket_fill_skb(), return -EINVAL when skb->len is zero, and ensure tpacket_snd() (via af_packet) does not send zero-byte data into the TPACKET ring buffer (i.e., prevent forwarding empty skbs that trigger skb_assert_len / WARN in __dev_queue_xmit()).

    net/packet/af_packet (Linux kernel / TPACKET ring buffer) tpacket_snd() behavior for 0-byte packets = reject zero-byte packets (do not send), and return -EINVAL when skb->len is zero in tpacket_fill_skb()

Event History

Sep 3, 2026
CVE Published
via MITRE·08:26 AM
Data Sourced
via MITRE·08:26 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the warning?

An attacker or local process must send a zero-byte packet through an AF_PACKET TPACKET ring buffer. The target network device must have no hard header, such as a device where hard_header_len is zero.

2

What is the impact of the flawed behavior?

The empty skb is forwarded to packet_xmit(), causing __dev_queue_xmit() to trigger skb_assert_len(skb). The provided data describes a kernel WARNING rather than a stated privilege escalation, information disclosure, or remote code execution impact.

3

How does the fix change packet handling?

The fix makes tpacket_fill_skb() return -EINVAL when the skb length is zero. This rejects zero-length packets before they reach the transmit path.

4

Are other AF_PACKET send paths covered by similar checks?

Yes. The description states that packet_snd() and packet_sendmsg_spkt() already contain comparable zero-length packet checks; the missing validation was in the TPACKET ring-buffer send path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203