Executive brief
The Linux kernel's tap networking driver, used for virtual networking in hypervisors and containers, contains a NULL pointer dereference vulnerability in XDP buffer processing. When virtio network header parsing occurs before the network device is properly assigned, a kernel crash can be triggered, causing denial of service to systems relying on virtual networking.
Technical details
The vulnerability is a NULL pointer dereference in the tap_get_user_xdp() function of drivers/net/tap.c. The root cause is that the function parses a virtio-net header via tun_vnet_hdr_to_skb() before assigning skb->dev, even though the header parsing may invoke dev_parse_header_protocol() which dereferences skb->dev. The attack vector requires network access to inject XDP buffers with crafted GSO virtio-net headers where the protocol field is set to zero. An unauthenticated remote attacker can trigger a kernel crash by sending specially crafted packets through the vhost TX path, resulting in denial of service. The fix reorders operations to assign skb->dev before parsing the virtio-net header, matching the pattern already applied in the related tap_get_user() function.
Affected products
- Linux Linux kernel Multiple kernel versions (4.x through 7.x branches affected)
Timeline
- 2026-08-22: disclosed
- 2026-08-23: patched