In the Linux kernel, the following vulnerability has been resolved:

af_packet: Don't send zero-byte data in tpacket_snd().

syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():

skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len
WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781

Call Trace:
<TASK>
dev_queue_xmit include/linux/netdevice.h:3448 [inline]
packet_xmit+0x243/0x310 net/packet/af_packet.c:276
tpacket_snd net/packet/af_packet.c:2907 [inline]
packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134

When sending 0-byte packets via TPACKET ring buffer on devices with no
hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
hit skb_assert_len(skb).

Similar checks exist in packet_snd() via commit dc633700f00f
("net/af_packet: check len when min_header_len equals to 0") and in
packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
zero-byte data in packet_sendmsg_spkt().").

Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
zero-length packets in tpacket_snd().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 80a702964467b998d254f16cc61c2c9a20540c9d
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 7521e691c7c4f2231634c95053281ac888d1f452
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 1fc70b3d513bafb16b17540178870ef46e81c0bb
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 3fa110f9e2ea96f567f2194c673c4bc327640111
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 98c5914d6b7bd4b4675535908e57dea31f1efd6a
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < f09ac5682f1bb67981fcb6ead4d3cfe439225876
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6bcd76c134c55c697148acb5c0194e9666abdf84
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
5.10.266 unaffected ≤ 5.10.*
5.15.217 unaffected ≤ 5.15.*
6.1.184 unaffected ≤ 6.1.*
6.6.153 unaffected ≤ 6.6.*
6.12.105 unaffected ≤ 6.12.*
6.18.46 unaffected ≤ 6.18.*
7.1.10 unaffected ≤ 7.1.*
7.2 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1fc70b3d513bafb16b17540178870ef46e81c0bb cve-icon cve-icon
https://git.kernel.org/stable/c/3fa110f9e2ea96f567f2194c673c4bc327640111 cve-icon cve-icon
https://git.kernel.org/stable/c/6bcd76c134c55c697148acb5c0194e9666abdf84 cve-icon cve-icon
https://git.kernel.org/stable/c/7521e691c7c4f2231634c95053281ac888d1f452 cve-icon cve-icon
https://git.kernel.org/stable/c/80a702964467b998d254f16cc61c2c9a20540c9d cve-icon cve-icon
https://git.kernel.org/stable/c/98c5914d6b7bd4b4675535908e57dea31f1efd6a cve-icon cve-icon
https://git.kernel.org/stable/c/dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe cve-icon cve-icon
https://git.kernel.org/stable/c/f09ac5682f1bb67981fcb6ead4d3cfe439225876 cve-icon cve-icon
History

Thu, 03 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-398
CWE-647

Thu, 03 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd(): skb_assert_len WARNING: at include/linux/skbuff.h:2753 skb_assert_len WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781 Call Trace: <TASK> dev_queue_xmit include/linux/netdevice.h:3448 [inline] packet_xmit+0x243/0x310 net/packet/af_packet.c:276 tpacket_snd net/packet/af_packet.c:2907 [inline] packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134 When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb() populates an skb with skb->len == 0 and returns 0. tpacket_snd() then forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to hit skb_assert_len(skb). Similar checks exist in packet_snd() via commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0") and in packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send zero-byte data in packet_sendmsg_spkt()."). Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject zero-length packets in tpacket_snd().
Title af_packet: Don't send zero-byte data in tpacket_snd().
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-03T08:26:25.920Z

Reserved: 2026-08-26T14:34:25.790Z

Link: CVE-2026-80742

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T13:06:13.437

Modified: 2026-09-03T13:06:13.437

Link: CVE-2026-80742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T17:00:06Z

Weaknesses