{"id":"CVE-2026-31684","title":"net: sched: act_csum: validate nested VLAN headers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb->data when an\nskb still carries in-payload VLAN tags. The…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 0410c619e86551677fb79887a38eccad3f5a0725","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 886469b6455611a511aa6013e957e15e50577513","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < a69738efea0996d05a3c7d2178551b891744df1b","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < ec4930979b3f7bbeb7af5744599fc6603a4dba62","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 3d165d975305cf76ff0b10a3c798fb31e5f5f9a5","Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < c842743d073bdd683606cb414eb0ca84465dd834","Linux 3764bfae5056e95617b6ee074129297e11710886","Linux >= 4.19.99 < 4.20","Linux 5.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:24:14.457468Z"},"published":"2026-04-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:22.781Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31684","references":[{"url":"https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725"},{"url":"https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513"},{"url":"https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"},{"url":"https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"},{"url":"https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b"},{"url":"https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62"},{"url":"https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"},{"url":"https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834"}],"tags":["cve.org"],"epss":0.00117,"epssPercentile":0.01668,"ingestedAt":"2026-11-06T15:54:04.047Z","slug":"CVE-2026-31684","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb->data when an\nskb still carries in-payload VLAN tags. The current code reads\nvlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without\nfirst ensuring that the full VLAN header is present in the linear area.\n\nIf only part of an inner VLAN header is linearized, accessing\nh_vlan_encapsulated_proto reads past the linear area, and the following\nskb_pull(VLAN_HLEN) may violate skb invariants.\n\nFix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and\npulling each nested VLAN header. If the header still is not fully\navailable, drop the packet through the existing error path.\n\n## Affected\n\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 0410c619e86551677fb79887a38eccad3f5a0725`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 886469b6455611a511aa6013e957e15e50577513`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < a69738efea0996d05a3c7d2178551b891744df1b`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < ec4930979b3f7bbeb7af5744599fc6603a4dba62`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < 3d165d975305cf76ff0b10a3c798fb31e5f5f9a5`\n- `Linux >= 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 < c842743d073bdd683606cb414eb0ca84465dd834`\n- `Linux 3764bfae5056e95617b6ee074129297e11710886`\n- `Linux >= 4.19.99 < 4.20`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}