Out-of-Bounds Write Vulnerability in Linux Kernel Network Stack

CVE-2026-80731

What is CVE-2026-80731?

A vulnerability exists in the Linux kernel's network stack due to improper handling of header lengths when the CAP_SYS_RAWIO capability is present. The function dev_validate_header readjusts the length of link layer headers and zero-pads data, which can lead to out-of-bounds writes if the device's hard header length is modified shortly before this function is called. Specifically, if the hard header length increases, the memset operation could write beyond the allocated buffer, potentially leading to security risks, including data corruption or exploitation. By removing the zero-padding logic for CAP_SYS_RAWIO users, this patch ensures consistent and safe reading of header lengths, mitigating the risk of unintended memory overwrites.

References