PT-2026-36330 · Linux · Linux Kernel
CVE-2026-31700
·
Published
2026-04-18
·
Updated
2026-07-28
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the
tpacket snd() function when PACKET VNET HDR is enabled. The vnet hdr points to a memory-mapped TX ring buffer shared with userspace. Although the kernel validates the header using the packet snd vnet parse() function, it subsequently re-reads the fields in the virtio net hdr to skb() function. This allows a concurrent userspace thread to modify the vnet hdr fields after validation but before use, effectively bypassing safety checks.Recommendations
Copy
vnet hdr from the memory-mapped ring buffer to a stack-local variable before validation and use.Exploit
Fix
Race Condition
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel