CVE-2026-31700

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-31700 is a time-of-check-to-time-of-use (TOCTOU) race condition in the Linux kernel's net/packet subsystem, specifically within the tpacket_snd() function. The vulnerability arises when PACKET_VNET_HDR is enabled and vnet_hdr points directly into an mmap'd TX ring buffer shared with userspace. The kernel validates the header using __packet_snd_vnet_parse(), but later re-reads the fields in virtio_net_hdr_to_skb(), allowing modifications in the interim. This issue is unique to the TPACKET TX path, as other vnet_hdr consumers like packet_snd(), tun.c, tap.c, and virtio_net.c properly copy data to stack-local variables.

A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit this by running a concurrent userspace thread that modifies the vnet_hdr fields in the shared mmap'd ring buffer after validation but before the kernel's subsequent read. This bypasses all safety checks, potentially leading to high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), as scored at CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker requires access to a system running a vulnerable kernel with TPACKET and PACKET_VNET_HDR in use.

Mitigation involves applying upstream kernel patches, such as those in the referenced stable commits (e.g., 28324a3b62d9ce7f9bdd65a8ce63f382041d1b27, 2c054e17d9d41f1020376806c7f750834ced4dc5), which fix the issue by copying vnet_hdr from the mmap'd ring buffer to a stack-local variable before validation and use, aligning with the approach in packet_snd() and other kernel consumers.