CVE-2026-31684
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
net: sched: act_csum: validate nested VLAN headers
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | 0410c619e86551677fb79887a38eccad3f5a0725 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | 886469b6455611a511aa6013e957e15e50577513 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | 46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | a69738efea0996d05a3c7d2178551b891744df1b | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | ec4930979b3f7bbeb7af5744599fc6603a4dba62 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | 3d165d975305cf76ff0b10a3c798fb31e5f5f9a5 | Unavailable | None listed |
| 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 | affected | git | c842743d073bdd683606cb414eb0ca84465dd834 | Unavailable | None listed |
| 3764bfae5056e95617b6ee074129297e11710886 | affected | git | Unavailable | Unavailable | None listed |
| 4.19.99 | affected | semver | 4.20 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.1 | Unavailable | None listed |
| 5.10.258 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.209 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.175 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.136 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.83 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.24 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.14 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |