UBUNTU-CVE-2026-80841: High severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmalloc mapping. tpacketdestructskb() currently drops the pending reference before writing the timestamp and TPSTATUSAVAILABLE to the frame. Move the decrement after those stores. The smpwmb() in packetsetstatus() orders the frame stores before the decrement. Also recheck pending TX frames under pgveclock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pgvec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to systemlongwq. After pgvec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sockwfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move pendingrefcnt release to packetsockdestruct() so late skb destructors and deferred cleanup can safely use it after packetrelease(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
During TX ring setup, allocate deferred-work storage when the first vmalloc-backed block is encountered, store its pointer in the pg_vec allocation header, and return -ENOMEM if the allocation fails.
- Compensating control
Before replacing a non-closing ring, recheck pending TX frames under pg_vec_lock; if TX skbs remain, defer the whole vector to system_long_wq, retain a socket reference, and reschedule deferred work until no TX skbs remain.
- Compensating control
Move pending_refcnt release to packet_sock_destruct(), perform the decrement after the frame timestamp and TP_STATUS_AVAILABLE stores, and use socket write-memory accounting through the final sock_wfree() as the deferred lifetime gate.