Executive brief
The Linux kernel contains a bug in how it processes network frames tagged with VLAN identifiers. When sending or receiving VLAN-tagged traffic, the kernel incorrectly calculates where the transport layer (TCP/UDP) headers are located in the packet, leaving the value uninitialized. This can cause packets to be mishandled or dropped, potentially affecting network connectivity and application performance.
Technical details
The vulnerability exists in packet_parse_headers() and the interaction with skb_probe_transport_header(). When processing VLAN-tagged frames, the network_header is advanced past the VLAN tag before calling skb_probe_transport_header(), but skb->protocol still contains the outer VLAN EtherType. This causes the flow dissector to misinterpret the inner protocol header as a VLAN header, resulting in an uninitialized transport_header field (set to ~0U sentinel value). The fix reorders function calls so that skb_probe_transport_header() is invoked before advancing the network_header, allowing the dissector to correctly parse the VLAN tag and extract the inner EtherType. This is a kernel memory corruption/state management issue affecting network packet processing.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched