Description

In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send paths call dev_validate_header() on skbs whose headroom was allocated from an earlier hard_header_len read. If the device is reconfigured so that dev->hard_header_len increases before validation, the memset writes past the reserved buffer, an out-of-bounds write. This out-of-bounds write is masked in some SOCK_RAW paths today because the same concurrent increase can first make skb_push() exceed the reserved headroom and trigger skb_under_panic(). Remove the zero-padding branch before making those hard_header_len reads consistent, so the snapshot fixes do not turn a loud panic into a silent overwrite. This path is only reached for variable length L2 protocols, where len < hard_header_len but len >= min_header_len. No remaining in-tree variable length L2 protocol implements header_ops->validate, and the CAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no real value beyond allowing testing of intentionally malformed input. Drop the CAP_SYS_RAWIO branch. The remaining reads of dev->hard_header_len in dev_validate_header() are comparisons only and have no memory safety impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:11.707Z",
  "pubdate": "2026-09-03T13:06:11.707Z",
  "executiveSummary": "The Linux kernel contains an out-of-bounds (OOB) write vulnerability within the dev_validate_header() function. This flaw arises from a logic error in how zero-padding is applied to short link-layer headers when a process possesses the CAP_SYS_RAWIO capability.\nThe vulnerability occurs when a device's hard_header_len is dynamically increased between the initial skb headroom allocation and the subsequent validation process. An attacker with CAP_SYS_RAWIO privileges can trigger a memory corruption event by forcing a memset operation beyond the bounds of the reserved buffer.\nThe primary risk involves the potential for kernel memory corruption, which may lead to system instability, kernel panics, or potential privilege escalation paths. This issue affects Linux kernel configurations utilizing variable-length L2 protocols.\nWhile the vulnerability requires CAP_SYS_RAWIO privileges—typically restricted to root or highly privileged users—the reliance on an inconsistent state of dev->hard_header_len makes this a critical memory safety concern. The fix necessitates the removal of the problematic zero-padding branch to eliminate the out-of-bounds write primitive entirely.",
  "technicalDetails": "The vulnerability resides in net/core/dev.c within the dev_validate_header() function. Historically, this function allowed users possessing CAP_SYS_RAWIO to bypass standard validation checks by zero-padding short link-layer headers to match the device's hard_header_len.\nThe root cause is a race condition related to the state of dev->hard_header_len. The packet send path typically allocates skb headroom based on the hard_header_len value at the time of allocation. If the underlying network device is reconfigured or updated, causing hard_header_len to increase after the headroom is already reserved but before dev_validate_header() is invoked, the function performs a memset operation using the new, larger value.\nWhen dev_validate_header() executes, it calculates the padding length using the updated dev->hard_header_len. Because the allocated buffer was sized based on a previous, smaller value, the calculation 'dev->hard_header_len - len' results in an offset that exceeds the buffer's allocated capacity. Consequently, the memset operation writes zeros into memory adjacent to the skb's data area, resulting in an OOB write.\nThis vulnerability is specifically relevant to variable-length L2 protocols where the packet header length is less than the current hard_header_len. In standard kernel operations, this was previously masked by skb_under_panic() in certain SOCK_RAW paths, where concurrent changes to header lengths would cause the skb_push() operation to fail before the OOB write could occur. However, the existing logic created a silent memory corruption vector that was potentially exploitable.\nThe exploit flow involves: 1) Establishing a socket with CAP_SYS_RAWIO capabilities. 2) Triggering a reconfiguration of the network device to increase hard_header_len. 3) Supplying a short L2 header that triggers the memset validation path. 4) The kernel subsequently overwrites memory outside the intended buffer. Due to the removal of the CAP_SYS_RAWIO zero-padding branch, the kernel no longer attempts to extend these headers, effectively closing the memory safety gap by disallowing the dangerous padding operation entirely."
}