{"id":"CVE-2026-31503","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) fo…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) fo…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-253"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.33.1, < 6.1.168","linux_kernel >= 6.2, < 6.6.131","linux_kernel >= 6.7, < 6.12.80","linux_kernel >= 6.13, < 6.18.21","linux_kernel >= 6.19, < 6.19.11","linux_kernel = 2.6.33","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.11"],"published":"2026-04-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:08.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31503","references":[{"url":"https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31503.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-31503"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460736"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31503"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31503"},{"url":"https://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31503-602a@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:64775"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00125,"epssPercentile":0.02212,"ingestedAt":"2026-09-08T15:33:26.990Z","slug":"CVE-2026-31503","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1,  \"[fd00::1]:8888\")\nbind(fd2,  \"[fd00::2]:8888\")\nbind(fd3,  \"[fd00::3]:8888\")\nbind(fd4,  \"[fd00::4]:8888\")\nbind(fd5,  \"[fd00::5]:8888\")\nbind(fd6,  \"[fd00::6]:8888\")\nbind(fd7,  \"[fd00::7]:8888\")\nbind(fd8,  \"[fd00::8]:8888\")\nbind(fd9,  \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\")      /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix.\n\n## Affected\n\n- `linux_kernel >= 2.6.33.1, < 6.1.168`\n- `linux_kernel >= 6.2, < 6.6.131`\n- `linux_kernel >= 6.7, < 6.12.80`\n- `linux_kernel >= 6.13, < 6.18.21`\n- `linux_kernel >= 6.19, < 6.19.11`\n- `linux_kernel = 2.6.33`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.11`\n\n## Vendor advisories\n\n- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31503.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201599,"id":"CVE-2026-31503","ts":1789399512376,"field":"cvss","old":null,"new":"5.5"},{"seq":201598,"id":"CVE-2026-31503","ts":1789399512376,"field":"severity","old":"none","new":"medium"},{"seq":200331,"id":"CVE-2026-31503","ts":1789397087879,"field":"cvss","old":"5.5","new":null},{"seq":200330,"id":"CVE-2026-31503","ts":1789397087879,"field":"severity","old":"medium","new":"none"},{"seq":198255,"id":"CVE-2026-31503","ts":1789391750780,"field":"cvss","old":null,"new":"5.5"},{"seq":198254,"id":"CVE-2026-31503","ts":1789391750780,"field":"severity","old":"none","new":"medium"},{"seq":196048,"id":"CVE-2026-31503","ts":1789383400865,"field":"cvss","old":"5.5","new":null},{"seq":196047,"id":"CVE-2026-31503","ts":1789383400865,"field":"severity","old":"medium","new":"none"},{"seq":194977,"id":"CVE-2026-31503","ts":1789380302945,"field":"cvss","old":null,"new":"5.5"},{"seq":194976,"id":"CVE-2026-31503","ts":1789380302945,"field":"severity","old":"none","new":"medium"},{"seq":193764,"id":"CVE-2026-31503","ts":1789378270379,"field":"cvss","old":"5.5","new":null},{"seq":193763,"id":"CVE-2026-31503","ts":1789378270379,"field":"severity","old":"medium","new":"none"},{"seq":192551,"id":"CVE-2026-31503","ts":1789376234760,"field":"cvss","old":null,"new":"5.5"},{"seq":192550,"id":"CVE-2026-31503","ts":1789376234760,"field":"severity","old":"none","new":"medium"},{"seq":191338,"id":"CVE-2026-31503","ts":1789373128078,"field":"cvss","old":"5.5","new":null},{"seq":191337,"id":"CVE-2026-31503","ts":1789373128078,"field":"severity","old":"medium","new":"none"},{"seq":190123,"id":"CVE-2026-31503","ts":1789369122514,"field":"cvss","old":null,"new":"5.5"},{"seq":190122,"id":"CVE-2026-31503","ts":1789369122514,"field":"severity","old":"none","new":"medium"},{"seq":188910,"id":"CVE-2026-31503","ts":1789368039864,"field":"cvss","old":"5.5","new":null},{"seq":188909,"id":"CVE-2026-31503","ts":1789368039864,"field":"severity","old":"medium","new":"none"},{"seq":187693,"id":"CVE-2026-31503","ts":1789364997888,"field":"cvss","old":null,"new":"5.5"},{"seq":187692,"id":"CVE-2026-31503","ts":1789364997888,"field":"severity","old":"none","new":"medium"},{"seq":186480,"id":"CVE-2026-31503","ts":1789363003905,"field":"cvss","old":"5.5","new":null},{"seq":186479,"id":"CVE-2026-31503","ts":1789363003905,"field":"severity","old":"medium","new":"none"},{"seq":185266,"id":"CVE-2026-31503","ts":1789360971119,"field":"cvss","old":null,"new":"5.5"},{"seq":185265,"id":"CVE-2026-31503","ts":1789360971119,"field":"severity","old":"none","new":"medium"},{"seq":184053,"id":"CVE-2026-31503","ts":1789357944891,"field":"cvss","old":"5.5","new":null},{"seq":184052,"id":"CVE-2026-31503","ts":1789357944891,"field":"severity","old":"medium","new":"none"},{"seq":182305,"id":"CVE-2026-31503","ts":1789354099266,"field":"cvss","old":null,"new":"5.5"},{"seq":182304,"id":"CVE-2026-31503","ts":1789354099266,"field":"severity","old":"none","new":"medium"},{"seq":181098,"id":"CVE-2026-31503","ts":1789352945118,"field":"cvss","old":"5.5","new":null},{"seq":181097,"id":"CVE-2026-31503","ts":1789352945118,"field":"severity","old":"medium","new":"none"},{"seq":179891,"id":"CVE-2026-31503","ts":1789350002745,"field":"cvss","old":null,"new":"5.5"},{"seq":179890,"id":"CVE-2026-31503","ts":1789350002745,"field":"severity","old":"none","new":"medium"},{"seq":178684,"id":"CVE-2026-31503","ts":1789347815855,"field":"cvss","old":"5.5","new":null},{"seq":178683,"id":"CVE-2026-31503","ts":1789347815855,"field":"severity","old":"medium","new":"none"},{"seq":177477,"id":"CVE-2026-31503","ts":1789346183060,"field":"cvss","old":null,"new":"5.5"},{"seq":177476,"id":"CVE-2026-31503","ts":1789346183060,"field":"severity","old":"none","new":"medium"},{"seq":176270,"id":"CVE-2026-31503","ts":1789342753445,"field":"cvss","old":"5.5","new":null},{"seq":176269,"id":"CVE-2026-31503","ts":1789342753445,"field":"severity","old":"medium","new":"none"},{"seq":176054,"id":"CVE-2026-31503","ts":1789342359992,"field":"cvss","old":null,"new":"5.5"},{"seq":176053,"id":"CVE-2026-31503","ts":1789342359992,"field":"severity","old":"none","new":"medium"},{"seq":175594,"id":"CVE-2026-31503","ts":1789338391442,"field":"cvss","old":"5.5","new":null},{"seq":175593,"id":"CVE-2026-31503","ts":1789338391442,"field":"severity","old":"medium","new":"none"},{"seq":174389,"id":"CVE-2026-31503","ts":1789334606140,"field":"cvss","old":null,"new":"5.5"},{"seq":174388,"id":"CVE-2026-31503","ts":1789334606140,"field":"severity","old":"none","new":"medium"},{"seq":173184,"id":"CVE-2026-31503","ts":1789333220004,"field":"cvss","old":"5.5","new":null},{"seq":173183,"id":"CVE-2026-31503","ts":1789333220004,"field":"severity","old":"medium","new":"none"},{"seq":171998,"id":"CVE-2026-31503","ts":1789330886039,"field":"cvss","old":null,"new":"5.5"},{"seq":171997,"id":"CVE-2026-31503","ts":1789330886039,"field":"severity","old":"none","new":"medium"}]}