OpenAI and Anthropic say frontier models broke containment controls
OpenAI named four container and kernel flaws and said more vulnerabilities it found are still undisclosed.
74
CVE-2026-80841
Use-after-free in Linux kernel AF_PACKET TX_RING
- CVSS
- —
- EPSS
- <1%p6
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-80841 is a Linux kernel memory-safety flaw in AF_PACKET TX_RING handling. Transmit skbs keep a raw pointer to their ring frame, and freeing a vmalloc-backed ring while those skbs are still completing can use that pointer after the vmalloc mapping is gone; a race on non-closing ring replacement can also leave a pending send across the ring swap. A local process that can create packet sockets (typically CAP_NET_RAW) may crash the kernel or corrupt memory, with privilege escalation not ruled out by the fix description. Essentially any Linux system whose kernel includes this net/packet code is in scope, but version ranges are not listed in the advisory. There is no public proof of concept, it is not on the CISA KEV list, and EPSS is about 0.2 percent.
What to do: Install a distribution kernel update that includes the net/packet TX_RING fix as soon as it is published; the CVE data does not name a fixed version. Until then, do not grant CAP_NET_RAW or AF_PACKET socket access to untrusted local users, and treat unexplained kernel crashes in packet transmit as possible hits on this bug.
| Product | Affected |
|---|---|
| Linux kernel | — |
Estimated exposure
massOn the order of 100 million+ Linux systems (exact unpatched count unknown) — CONFIG_PACKET and AF_PACKET are built into typical distribution kernels, and Linux runs on well over 100 million servers, cloud instances, desktops, and embedded devices; exact vulnerable version ranges were not published, so this is an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping. tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.