CVE-2026-31675net/sched: sch_netem: fix out-of-bounds access in packet corruption
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0. Passing 0 to get_random_u32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access. Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c865e5d99e25a171e8262fc0f7ba608568633c64 before a14b56863348686dd0387eea8ce66b85cf455908; from c865e5d99e25a171e8262fc0f7ba608568633c64 before 13a66ca1e235d4bcd53d12d4c68490cad7f8e46f; from c865e5d99e25a171e8262fc0f7ba608568633c64 before 3a2999704ac36cfb4041fed3652d26a3373e8d12; from c865e5d99e25a171e8262fc0f7ba608568633c64 before 4fd258e281fa8bc15e9ce2c7691941537e9258ad; from c865e5d99e25a171e8262fc0f7ba608568633c64 before d64cb81dcbd54927515a7f65e5e24affdc73c14b | CNA record |
linux linux_kernel linux:linux_kernel | from 2.6.16 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; 7.0; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/a14b56863348686dd0387eea8ce66b85cf455908patch
- https://git.kernel.org/stable/c/13a66ca1e235d4bcd53d12d4c68490cad7f8e46fpatch
- https://git.kernel.org/stable/c/3a2999704ac36cfb4041fed3652d26a3373e8d12patch
- https://git.kernel.org/stable/c/4fd258e281fa8bc15e9ce2c7691941537e9258adpatch
- https://git.kernel.org/stable/c/d64cb81dcbd54927515a7f65e5e24affdc73c14bpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.