Executive brief
The Linux kernel's TAP (network tap) driver, used in virtual networking to intercept and analyze network traffic, contains a logic error when handling VLAN-tagged network frames. This can cause the driver to incorrectly parse packet headers, leading to improper packet handling or potential network service disruptions in virtualized environments using tap networking.
Technical details
The vulnerability exists in the tap_get_user_xdp() function in drivers/net/tap.c. When processing VLAN-tagged frames (ETH_P_8021Q), the code calls skb_set_network_header() before skb_probe_transport_header(), causing network_header to advance past the VLAN tag while skb->protocol still references ETH_P_8021Q. The flow dissector then misinterprets the inner protocol header as a VLAN header, returning false and leaving transport_header uninitialized (~0U). The fix reorders these calls so skb_probe_transport_header() is invoked before skb_set_network_header(), allowing the dissector to correctly parse the VLAN header and extract the inner EtherType. This is a logic error in packet header processing with no known remote exploitation path.
Affected products
- Linux Linux kernel affected versions prior to fix commit cbb35cbe8db268fefe34c23df15348cf99025298
Timeline
- 2026-09-04: disclosed: CVE published in NVD
- 2026-08-23: patched: Fix commits merged into stable kernel branches