CVE-2026-31684

Katalog CVE

CVSS 5.5 · Medium EPSS 0,12%

Kerentanan pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

Rincian

Terbit di NVD

25 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5 patch
• https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b patch
• https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834 patch
• https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2 patch
• https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62 patch
• https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725
• https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09
• https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513