CVE-2026-80906: net: packet: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved:

net: packet: fix wrong transportheader when sending VLAN-tagged frame

In packetparseheaders(), when processing a VLAN-tagged frame, skbsetnetworkheader() is called to advance networkheader past the VLAN tag to the inner protocol header. skbprobetransportheader() is then called with skb->protocol still set to the outer VLAN EtherType (e.g. ETHP8021Q), while nhoff (derived from skbnetworkoffset()) already points past the VLAN tag to the inner protocol header.

In skbflowdissect(), proto is initialized to ETHP8021Q and nhoff points past the VLAN tag. When the dissector hits case ETHP8021Q, it reads a struct vlanhdr at nhoff via skbheaderpointer(), but that offset contains the inner protocol header (e.g. an IP header). The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no known protocol. The dissector returns false, so skbprobetransportheader() never calls skbsettransportheader(), leaving transportheader at its uninitialized sentinel value (~0U).

Move skbprobetransportheader() to before skbsetnetworkheader(). At the time skbprobetransportheader() is called, networkheader still points to the VLAN header, so nhoff correctly points to the VLAN header. The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the inner protocol header, allowing transportheader to be set correctly.