Executive brief
The Linux kernel's af_packet networking subsystem can be triggered to generate a kernel warning when processing zero-byte packets via TPACKET, resulting in a denial of service through kernel instability. This affects systems that allow unprivileged user applications to send raw network packets, such as packet capture utilities or custom networking tools.
Technical details
The vulnerability is a logic error in the tpacket_snd() function in net/packet/af_packet.c. When sending 0-byte packets via the TPACKET ring buffer interface on devices with no hard header (hard_header_len == 0), the tpacket_fill_skb() function creates a socket buffer with zero length and passes it to packet_xmit(), which triggers a kernel assertion in __dev_queue_xmit(). No authentication is required; any process with CAP_NET_RAW or CAP_NET_ADMIN capability can trigger this. The fix adds a check in tpacket_fill_skb() to return -EINVAL when skb->len is zero, rejecting zero-length packets before they reach packet_xmit().
Affected products
- Linux Linux kernel 2.6.12 and later (fixed in upstream; backported to multiple stable branches)
Timeline
- 2026-09-03: disclosed: Published on NVD
- 2026-08-10: patched: Upstream fix committed by Eric Dumazet
- 2026-08-23: patched: Backported to stable kernel branches