UBUNTU-CVE-2026-80925: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX) on a lower device invokes vlantransferfeatures(), which dynamically changed vlandev->hardheaderlen. This causes two issues: 1. Lockless TX paths (e.g. packetsnd in afpacket.c, ip6finishoutput2) read dev->hardheaderlen without holding RTNL lock. Mutating hardheaderlen dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a stale hardheaderlen, resulting in skbunderpanic when vlandevhardheader() is called. 2. In addition, vlantransferfeatures() updated hardheaderlen without updating headerops, causing a mismatch between allocated headroom and header creation. Always setting dev->hardheaderlen = realdev->hardheaderlen and dev->neededheadroom = realdev->neededheadroom + VLANHLEN unconditionally ensures: - dev->hardheaderlen remains 100% static and immutable at realdev->hardheaderlen, eliminating all dynamic runtime updates and data races on hardheaderlen. - Upper layers allocating skbs via LLRESERVEDSPACE() will always reserve sufficient headroom for software VLAN tag insertion (realdev->hardheaderlen + realdev->neededheadroom + VLANHLEN). - vlandev inherits realdev->neededtailroom so underlying trailer/padding/ICV requirements are honored. - AFPACKET SOCKRAW network header offsets remain correctly aligned at realdev->hardheaderlen. - vlanheaderops is used unconditionally. Note to stable teams: Make sure to backport these commits: e16e960d55a4 ("ipvlan: inherit neededheadroom and neededtailroom from phydev") cef51860becd ("macvlan: inherit neededheadroom and neededtailroom from lowerdev")