--- id: CVE-2026-31503 title: |- In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) fo… summary: |- In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) fo… severity: medium cvss: 5.5 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-253 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 2.6.33.1, < 6.1.168' - 'linux_kernel >= 6.2, < 6.6.131' - 'linux_kernel >= 6.7, < 6.12.80' - 'linux_kernel >= 6.13, < 6.18.21' - 'linux_kernel >= 6.19, < 6.19.11' - linux_kernel = 2.6.33 - linux_kernel = 7.0 patched: - linux_kernel 6.19.11 published: '2026-04-22' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:19:08.900' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31503' references: - url: 'https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-082556.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31503.json - url: 'https://access.redhat.com/security/cve/CVE-2026-31503' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2460736' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-31503' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31503' - url: >- https://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31503-602a@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:64775' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00125 epssPercentile: 0.02212 ingestedAt: '2026-09-08T15:33:26.990Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10. "hash2" is keyed by local address and local port. "hash" is keyed by local port only. The issue can be shown in the following bind sequence (pseudo code): bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888") bind(fd10, "[fd00::10]:8888") /* Correctly return -EADDRINUSE because "hash" is used * instead of "hash2". udp_lib_lport_inuse() detects the * conflict. */ bind(fail_fd, "[::]:8888") /* After one more socket is bound to "[fd00::11]:8888", * hslot->count exceeds 10 and "hash2" is used instead. */ bind(fd11, "[fd00::11]:8888") bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */ The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10. TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix. ## Affected - `linux_kernel >= 2.6.33.1, < 6.1.168` - `linux_kernel >= 6.2, < 6.6.131` - `linux_kernel >= 6.7, < 6.12.80` - `linux_kernel >= 6.13, < 6.18.21` - `linux_kernel >= 6.19, < 6.19.11` - `linux_kernel = 2.6.33` - `linux_kernel = 7.0` ## Remediation Upgrade past the affected range: - `linux_kernel 6.19.11` ## Vendor advisories - **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31503.json)