Executive brief
The Linux kernel has a vulnerability in VLAN hardware offload toggling that causes two related issues: a data race when network interfaces toggle hardware VLAN acceleration, and a mismatch between allocated buffer space and actual header requirements. This can result in kernel panics when packets are transmitted through VLAN devices, potentially causing network service outages.
Technical details
The vulnerability arises from dynamic mutation of the hard_header_len field without holding the RTNL lock, creating a race condition where lockless TX paths (such as af_packet and IPv6 output) read stale values and reserve insufficient headroom. Additionally, vlan_transfer_features() updated hard_header_len without synchronizing updates to header_ops, causing a mismatch between allocated headroom and actual header creation requirements. The fix ensures hard_header_len remains static and immutable at the real device's value, while needed_headroom is unconditionally set to real_dev->needed_headroom + VLAN_HLEN, and vlan_header_ops is used unconditionally. This eliminates all dynamic runtime updates and guarantees sufficient headroom for software VLAN tag insertion across all code paths.
Affected products
- Linux Linux kernel multiple versions (unspecified)
Timeline
- 2026-09-09: disclosed