PT-2026-35144 · Linux · Linux

Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-31684

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: sched: act csum: validate nested VLAN headers

tcf csum act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h vlan encapsulated proto and then pulls VLAN HLEN bytes without first ensuring that the full VLAN header is present in the linear area.

If only part of an inner VLAN header is linearized, accessing h vlan encapsulated proto reads past the linear area, and the following skb pull(VLAN HLEN) may violate skb invariants.

Fix this by requiring pskb may pull(skb, VLAN HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.

Related Identifiers

CVE-2026-31684

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31684 · Security Note
• https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62 · Note
• https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5 · Note
• https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b · Note
• https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834 · Note