|
Vulnerabilities
< Back

CVE-2026-31700

Updated on 01 May 2026

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net/packet: fix TOCTOU race on mmap’d vnet_hdr in tpacket_snd()

In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap’d TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent userspace thread can modify the vnet_hdr fields between validation and use, bypassing all safety checks.

The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr to a stack-local variable. All other vnet_hdr consumers in the kernel (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX path is the only caller of virtio_net_hdr_to_skb() that reads directly from user-controlled shared memory.

Fix this by copying vnet_hdr from the mmap’d ring buffer to a stack-local variable before validation and use, consistent with the approach used in packet_snd() and all other callers.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
kernel @ 5.10.0 (+10 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Released
57 kernels
  • 6.1.79-99.164.amzn2023
  • 6.1.84-99.169.amzn2023
  • 6.1.82-99.168.amzn2023
  • 6.1.90-99.173.amzn2023
  • 6.1.87-99.174.amzn2023
  • 6.1.91-99.172.amzn2023
  • 6.1.97-104.177.amzn2023
  • 6.1.94-99.176.amzn2023
  • 6.1.102-108.177.amzn2023
  • 6.1.106-116.188.amzn2023
  • 6.1.102-111.182.amzn2023
  • 6.1.79-99.167.amzn2023
  • 6.1.92-99.174.amzn2023
  • 6.1.96-102.177.amzn2023
  • 6.1.109-118.189.amzn2023
  • 6.1.112-122.189.amzn2023
  • 6.1.111-120.187.amzn2023
  • 6.1.115-126.197.amzn2023
  • 6.1.119-129.201.amzn2023
  • 6.1.124-134.200.amzn2023
  • 6.1.127-135.201.amzn2023
  • 6.1.128-136.201.amzn2023
  • 6.1.129-138.220.amzn2023
  • 6.1.130-139.222.amzn2023
  • 6.1.131-143.221.amzn2023
  • 6.1.132-147.221.amzn2023
  • 6.1.134-150.224.amzn2023
  • 6.1.112-124.190.amzn2023
  • 6.1.140-154.222.amzn2023
  • 6.1.141-155.222.amzn2023
  • 6.1.134-152.225.amzn2023
  • 6.1.144-170.251.amzn2023
  • 6.1.147-172.266.amzn2023
  • 6.1.148-173.267.amzn2023
  • 6.1.150-174.273.amzn2023
  • 6.1.141-165.249.amzn2023
  • 6.1.141-167.250.amzn2023
  • 6.1.147-172.259.amzn2023
  • 6.1.153-175.280.amzn2023
  • 6.1.155-176.282.amzn2023
  • 6.1.156-177.286.amzn2023
  • 6.1.158-178.288.amzn2023
  • 6.1.159-181.297.amzn2023
  • 6.1.163-186.299.amzn2023
  • 6.1.158-180.294.amzn2023
  • 6.1.159-182.297.amzn2023
  • 6.1.161-183.298.amzn2023
  • 6.1.164-196.303.amzn2023
  • 6.1.166-197.305.amzn2023
  • 6.1.168-203.330.amzn2023
  • 6.1.168-202.320.amzn2023
  • 6.1.170-210.320.amzn2023
  • 6.1.170-213.321.amzn2023
  • 6.1.172-216.329.amzn2023
  • 6.1.174-217.345.amzn2023
  • 6.1.172-216.339.amzn2023
  • 6.1.170-208.319.amzn2023
Debian 11 Released
37 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 11 cloud Released
17 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
Debian 12 Released
40 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
Debian 13 Planned —
Ubuntu 24.04 Planned —