CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers
In the Linux kernel, the following vulnerability has been resolved:
net: sched: actcsum: validate nested VLAN headers
tcfcsumact() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->hvlanencapsulatedproto and then pulls VLANHLEN bytes without first ensuring that the full VLAN header is present in the linear area.
If only part of an inner VLAN header is linearized, accessing hvlanencapsulatedproto reads past the linear area, and the following skbpull(VLANHLEN) may violate skb invariants.
Fix this by requiring pskbmaypull(skb, VLANHLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31684?
CVE-2026-31684 has a medium severity rating due to its impact on network packet handling in the Linux kernel.
How do I fix CVE-2026-31684?
To mitigate CVE-2026-31684, update your Linux kernel to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-31684?
CVE-2026-31684 is a network vulnerability that involves incorrect handling of nested VLAN headers in the Linux kernel.
What versions of the Linux kernel are affected by CVE-2026-31684?
CVE-2026-31684 affects multiple versions of the Linux kernel that precede the patch that resolves the issue.
Can CVE-2026-31684 lead to a network compromise?
Yes, CVE-2026-31684 has the potential to be exploited, which could result in unauthorized access or network traffic manipulation.