{"id":"CVE-2026-31684","summary":"net: sched: act_csum: validate nested VLAN headers","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb-\u003edata when an\nskb still carries in-payload VLAN tags. The current code reads\nvlan-\u003eh_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without\nfirst ensuring that the full VLAN header is present in the linear area.\n\nIf only part of an inner VLAN header is linearized, accessing\nh_vlan_encapsulated_proto reads past the linear area, and the following\nskb_pull(VLAN_HLEN) may violate skb invariants.\n\nFix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and\npulling each nested VLAN header. If the header still is not fully\navailable, drop the packet through the existing error path.","modified":"2026-10-28T02:30:26.623109251Z","published":"2026-04-25T08:47:01.555Z","related":["ALSA-2026:21556","ALSA-2026:21557","ALSA-2026:21706","ALSA-2026:21745","SUSE-SU-2026:21834-1","SUSE-SU-2026:21841-1","SUSE-SU-2026:21845-1","SUSE-SU-2026:21860-1","SUSE-SU-2026:21876-1","SUSE-SU-2026:21877-1","SUSE-SU-2026:21916-1","SUSE-SU-2026:21919-1","SUSE-SU-2026:2217-1","SUSE-SU-2026:2238-1","openSUSE-SU-2026:20826-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31684.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"},{"type":"WEB","url":"https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31684.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31684"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6"},{"fixed":"0410c619e86551677fb79887a38eccad3f5a0725"},{"fixed":"886469b6455611a511aa6013e957e15e50577513"},{"fixed":"46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"},{"fixed":"eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"},{"fixed":"a69738efea0996d05a3c7d2178551b891744df1b"},{"fixed":"ec4930979b3f7bbeb7af5744599fc6603a4dba62"},{"fixed":"3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"},{"fixed":"c842743d073bdd683606cb414eb0ca84465dd834"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.19.99"},{"fixed":"4.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3764bfae5056e95617b6ee074129297e11710886"}]}],"versions":["v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v4.19.290","v4.19.289","v4.19.288","v4.19.287","v4.19.286","v4.19.285","v4.19.284","v4.19.283","v4.19.282","v4.19.281","v4.19.280","v4.19.279","v4.19.278","v4.19.277","v4.19.276","v4.19.275","v4.19.274","v4.19.273","v4.19.272","v4.19.271","v4.19.270","v4.19.269","v4.19.268","v4.19.267","v4.19.266","v4.19.265","v4.19.264","v4.19.263","v4.19.262","v4.19.261","v4.19.260","v4.19.259","v4.19.258","v4.19.257","v4.19.256","v4.19.255","v4.19.254","v4.19.253","v4.19.252","v4.19.251","v4.19.250","v4.19.249","v4.19.248","v4.19.247","v4.19.246","v4.19.245","v4.19.244","v4.19.243","v4.19.242","v4.19.241","v4.19.240","v4.19.239","v4.19.238","v4.19.237","v4.19.236","v4.19.235","v4.19.234","v4.19.233","v4.19.232","v4.19.231","v4.19.230","v4.19.229","v4.19.228","v4.19.227","v4.19.226","v4.19.225","v4.19.224","v4.19.223","v4.19.222","v4.19.221","v4.19.220","v4.19.219","v4.19.218","v4.19.217","v4.19.216","v4.19.215","v4.19.214","v4.19.213","v4.19.212","v4.19.211","v4.19.210","v4.19.209","v4.19.208","v4.19.207","v4.19.206","v4.19.205","v4.19.204","v4.19.203","v4.19.202","v4.19.201","v4.19.200","v4.19.199","v4.19.198","v4.19.197","v4.19.196","v4.19.195","v4.19.194","v4.19.193","v4.19.192","v4.19.191","v4.19.190","v4.19.189","v4.19.188","v4.19.187","v4.19.186","v4.19.185","v4.19.184","v4.19.183","v4.19.182","v4.19.181","v4.19.180","v4.19.179","v4.19.178","v4.19.177","v4.19.176","v4.19.175","v4.19.174","v4.19.173","v4.19.172","v4.19.171","v4.19.170","v4.19.169","v4.19.168","v4.19.167","v4.19.166","v4.19.165","v4.19.164","v4.19.163","v4.19.162","v4.19.161","v4.19.160","v4.19.159","v4.19.158","v4.19.157","v4.19.156","v4.19.155","v4.19.154","v4.19.153","v4.19.152","v4.19.151","v4.19.150","v4.19.149","v4.19.148","v4.19.147","v4.19.146","v4.19.145","v4.19.144","v4.19.143","v4.19.142","v4.19.141","v4.19.140","v4.19.139","v4.19.138","v4.19.137","v4.19.136","v4.19.135","v4.19.134","v4.19.133","v4.19.132","v4.19.131","v4.19.130","v4.19.129","v4.19.128","v4.19.127","v4.19.126","v4.19.125","v4.19.124","v4.19.123","v4.19.122","v4.19.121","v4.19.120","v4.19.119","v4.19.118","v4.19.117","v4.19.116","v4.19.115","v4.19.114","v4.19.113","v4.19.112","v4.19.111","v4.19.110","v4.19.109","v4.19.108","v4.19.107","v4.19.106","v4.19.105","v4.19.104","v4.19.103","v4.19.102","v4.19.101","v4.19.100","v4.19.99"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31684.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.10.258"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.209"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.136"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.83"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.24"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.14"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31684.json"}}],"schema_version":"1.9.2"}