Linux Kernel CVE-2026-80725

Requires the ability to inject crafted raw frames (e.g. via an AF_PACKET socket, which needs CAP_NET_RAW/root or an equivalently privileged container) carrying a MAC header under 8 bytes, on a system running an affected older stable kernel (5.19 through 6.18.y before the fixed builds) with BIG TCP GRO aggregation active on the receive path. The IPv6 OOB-write path specifically needs p->mac_header smaller than sizeof(struct hop_jumbo_hdr). Limiting factors: mainline 7.0+ is not vulnerable; the described trigger is local privileged frame injection rather than remote unauthenticated traffic, so despite the AV:N CVSS the practical vector is local; exploitation also depends on the flow qualifying for >64KB BIG TCP aggregation.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) reads as trivially remote and unauthenticated, but this conflicts with the described exploitation path: the crafted sub-8-byte MAC-header frames that trigger the OOB write are injected via AF_PACKET, which requires local access with CAP_NET_RAW/root. That makes the realistic vector local-privileged, not network-unauthenticated - a significant overstatement in the published score (verify with vendor). Supporting this, EPSS is only 0.19% (9th percentile) and there is no KEV listing and no public exploit, indicating no observed exploitation. The technical impact is genuine kernel memory corruption (potential privilege escalation or crash), so severity of a successful exploit is high, but reachability is far narrower than 9.8 implies. Overall this is a moderate, defense-in-depth priority for operators running affected 6.x stable kernels rather than an emergency internet-facing bug.

A local user or compromised container process with CAP_NET_RAW opens an AF_PACKET socket and injects crafted frames with a MAC header smaller than 8 bytes into a flow eligible for IPv6 BIG TCP GRO aggregation. When the stack completes aggregation and inserts the temporary HBH jumbo header, the memmove writes before skb->head, corrupting adjacent kernel heap memory - potentially leveraged into privilege escalation or a kernel crash. No public proof-of-concept exists at time of analysis.