CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish
In the Linux kernel, the following vulnerability has been resolved:
net/packet: defer vmalloc TXRING free until skbs finish
AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmalloc mapping.
tpacketdestructskb() currently drops the pending reference before writing the timestamp and TPSTATUSAVAILABLE to the frame. Move the decrement after those stores. The smpwmb() in packetsetstatus() orders the frame stores before the decrement.
Also recheck pending TX frames under pgveclock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap.
Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pgvec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to systemlongwq.
After pgvec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sockwfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain.
Move pendingrefcnt release to packetsockdestruct() so late skb destructors and deferred cleanup can safely use it after packetrelease(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.
Event History
Frequently Asked Questions
Which AF_PACKET users are exposed to this condition?
The condition applies to AF_PACKET sockets using TX_RING when the ring contains vmalloc-backed blocks. A ring can contain a mixture of page-backed and vmalloc-backed blocks; page references protect page-backed blocks but do not keep a vmalloc mapping valid.
When can the unsafe lifetime race occur?
It can occur when TX skbs still reference ring frames while the ring is being closed or replaced. A racing send can add a pending skb between an initial pending-frame check and a non-closing ring replacement.
What operational behavior does the fix add?
When closing a socket with remaining TX skbs and a vmalloc-backed ring vector, the fix defers freeing the entire vector to system_long_wq. TX ring setup now allocates deferred-work storage when it first encounters a vmalloc-backed block and returns -ENOMEM if that allocation fails.