CVE-2026-80742: af_packet: Don't send zero-byte data in tpacket_snd().
In the Linux kernel, the following vulnerability has been resolved:
afpacket: Don't send zero-byte data in tpacketsnd().
syzbot reported a WARNING in devqueuexmit() triggered via tpacketsnd():
skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970 net/core/dev.c:4781
Call Trace: <TASK> devqueuexmit include/linux/netdevice.h:3448 [inline] packetxmit+0x243/0x310 net/packet/afpacket.c:276 tpacketsnd net/packet/afpacket.c:2907 [inline] packetsendmsg+0x28d6/0x4eb0 net/packet/afpacket.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hardheaderlen == 0), tpacketfillskb() populates an skb with skb->len == 0 and returns 0. tpacketsnd() then forwards this empty skb to packetxmit(), causing devqueuexmit() to hit skbassertlen(skb).
Similar checks exist in packetsnd() via commit dc633700f00f ("net/afpacket: check len when minheaderlen equals to 0") and in packetsendmsgspkt() via commit 6a341729fb31 ("afpacket: Don't send zero-byte data in packetsendmsgspkt().").
Return -EINVAL in tpacketfillskb() when skb->len is zero to reject zero-length packets in tpacketsnd().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
net/packet/af_packet (Linux kernel)to a version that resolves this vulnerability.Patch dc633700f00f - Upgrade
Upgrade
net/packet/af_packet (Linux kernel)to a version that resolves this vulnerability.Patch 6a341729fb31 - Configuration
Implement the resolved behavior: in tpacket_fill_skb(), return -EINVAL when skb->len is zero, and ensure tpacket_snd() (via af_packet) does not send zero-byte data into the TPACKET ring buffer (i.e., prevent forwarding empty skbs that trigger skb_assert_len / WARN in __dev_queue_xmit()).
net/packet/af_packet (Linux kernel / TPACKET ring buffer) tpacket_snd() behavior for 0-byte packets = reject zero-byte packets (do not send), and return -EINVAL when skb->len is zero in tpacket_fill_skb()
Event History
Frequently Asked Questions
What conditions are required to trigger the warning?
An attacker or local process must send a zero-byte packet through an AF_PACKET TPACKET ring buffer. The target network device must have no hard header, such as a device where hard_header_len is zero.
What is the impact of the flawed behavior?
The empty skb is forwarded to packet_xmit(), causing __dev_queue_xmit() to trigger skb_assert_len(skb). The provided data describes a kernel WARNING rather than a stated privilege escalation, information disclosure, or remote code execution impact.
How does the fix change packet handling?
The fix makes tpacket_fill_skb() return -EINVAL when the skb length is zero. This rejects zero-length packets before they reach the transmit path.
Are other AF_PACKET send paths covered by similar checks?
Yes. The description states that packet_snd() and packet_sendmsg_spkt() already contain comparable zero-length packet checks; the missing validation was in the TPACKET ring-buffer send path.