PT-2026-36330 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-22 · CVE-2026-31700

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the tpacket snd() function when PACKET VNET HDR is enabled. The vnet hdr points to a memory-mapped TX ring buffer shared with userspace. Although the kernel validates the header using the packet snd vnet parse() function, it subsequently re-reads the fields in the virtio net hdr to skb() function. This allows a concurrent userspace thread to modify the vnet hdr fields after validation but before use, effectively bypassing safety checks.

Recommendations Copy vnet hdr from the memory-mapped ring buffer to a stack-local variable before validation and use.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-31700

ECHO-2473-011C-5F63

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 52

• https://ubuntu.com/security/CVE-2026-31700 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31700 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31700 · Security Note
• https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121 · Patch
• https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31700 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31700 · Security Note
• https://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b · Patch
• https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcdd · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31700 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-43073 · Note
• https://suse.com/security/cve/CVE-2026-43348 · Note