AZL-99036
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99036.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99036
- Upstream
- Published
- 2026-09-03T13:06:13Z
- Modified
- 2026-09-05T05:27:51Z
- Summary
- CVE-2026-80742 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
afpacket: Don't send zero-byte data in tpacketsnd().
syzbot reported a WARNING in _devqueuexmit() triggered via tpacketsnd():
skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at __devqueuexmit+0x21bc/0x4970 net/core/dev.c:4781
Call Trace: <TASK> devqueuexmit include/linux/netdevice.h:3448 [inline] packetxmit+0x243/0x310 net/packet/afpacket.c:276 tpacketsnd net/packet/afpacket.c:2907 [inline] packetsendmsg+0x28d6/0x4eb0 net/packet/afpacket.c:3134
When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hardheaderlen == 0), tpacketfillskb() populates an skb with skb->len == 0 and returns 0. tpacketsnd() then forwards this empty skb to packetxmit(), causing __devqueuexmit() to hit skbassertlen(skb).
Similar checks exist in packetsnd() via commit dc633700f00f ("net/afpacket: check len when minheaderlen equals to 0") and in packetsendmsgspkt() via commit 6a341729fb31 ("afpacket: Don't send zero-byte data in packetsendmsg_spkt().").
Return -EINVAL in tpacketfillskb() when skb->len is zero to reject zero-length packets in tpacket_snd().
- References