LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0. Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access. Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user can trigger a Linux kernel memory access outside valid bounds under a specific networking setup. Successful exploitation could crash a system or potentially compromise kernel-level confidentiality and integrity. The required combination—netem packet corruption, fully non-linear packets, AF_PACKET TX_RING, and an IPIP tunnel—limits exposure but does not eliminate risk on multi-user or network-testing hosts.

Executive priority

Prioritize remediation on shared Linux systems, network laboratories, CI infrastructure, appliances, and other hosts permitting lower-privileged local activity with advanced networking features. Treat as a scheduled high-priority kernel update, escalating urgency where the described configuration is present. Internet-facing status alone does not establish exposure because the documented attack vector is local.

Technical view

In netem_enqueue(), corruption logic selects an offset using skb_headlen(skb). For a fully non-linear packet, that length can be zero, causing get_random_u32_below(0) to return an unconstrained value. Using it against skb->data creates an out-of-bounds access. The fix skips corruption when the linear data area is empty.

Likely exposure

Exposure is most plausible where untrusted or lower-privileged local users can access affected Linux hosts and exercise the specific packet-processing path. Systems using netem corruption with AF_PACKET TX_RING and IPIP tunnels warrant priority review. The supplied version list is irregular, so exposure should be confirmed through kernel provenance and fix-commit status rather than version labels alone.

Exploitation context

The CVSS assessment is 7.8 with local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact. The source bundle does not report CISA KEV inclusion or active exploitation. It also provides no public proof-of-concept evidence, so real-world exploitation status remains unconfirmed.

Researcher notes

The vulnerable condition depends on skb_headlen(skb) returning zero for a fully non-linear packet. The correction adds a non-zero head-length check, causing those packets to bypass corruption. Five stable-kernel commit references are supplied. The affected-version metadata contains duplicates, an unexpected zero, and unclear boundaries; branch-specific commit ancestry is the safer validation method.

Mitigation direction

  • Apply the applicable vendor kernel update containing the referenced stable fix.
  • Confirm custom kernels include the relevant fix commit for their maintained branch.
  • Restrict untrusted local access while affected systems await kernel remediation.
  • Reduce use of the identified netem corruption, TX_RING, and IPIP combination where operationally feasible.
  • Check distribution or appliance vendor guidance for backport-specific remediation details.

Validation and detection

  • Inventory Linux kernel versions and identify vendor or custom build provenance.
  • Verify whether the applicable stable fix commit is present in each deployed kernel.
  • Identify hosts using netem packet corruption, AF_PACKET TX_RING, or IPIP tunnels.
  • Review kernel telemetry for unexplained crashes or memory-access faults around traffic control.
  • Retest required networking functions after updating, including expected handling of fully non-linear packets.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31675 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31675Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc865e5d99e25a171e8262fc0f7ba608568633c64, c865e5d99e25a171e8262fc0f7ba608568633c64, c865e5d99e25a171e8262fc0f7ba608568633c64, c865e5d99e25a171e8262fc0f7ba608568633c64, c865e5d99e25a171e8262fc0f7ba608568633c64unaffected
LinuxLinux2.6.16, 0, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.