CVE-2026-31675: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31675 Overview

CVE-2026-31675 is an out-of-bounds memory access vulnerability in the Linux kernel's network traffic control subsystem, specifically within the sch_netem (Network Emulator) scheduler. The vulnerability exists in the netem_enqueue() function's packet corruption logic, which can be triggered when processing fully non-linear packets sent via AF_PACKET TX_RING over an IPIP tunnel.

When an attacker sends specially crafted non-linear packets, the skb_headlen(skb) function returns zero. This zero value is then passed to get_random_u32_below(), which takes a variable-ceiling slow path and returns an unconstrained 32-bit random integer. Using this unbounded value as an index into skb->data results in an out-of-bounds memory access that could lead to information disclosure, memory corruption, or system instability.

Critical Impact

Local attackers with low privileges can trigger out-of-bounds memory access in the kernel's network scheduler, potentially leading to privilege escalation, kernel memory corruption, or denial of service conditions.

Affected Products

• Linux kernel with sch_netem network emulator module enabled
• Systems using AF_PACKET TX_RING with IPIP tunneling
• Linux kernel versions prior to the security patches

Discovery Timeline

• 2026-04-25 - CVE CVE-2026-31675 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31675

Vulnerability Analysis

The vulnerability resides in the network emulator (netem) qdisc module, which is used to simulate network conditions such as delay, packet loss, and packet corruption. The netem_enqueue() function implements packet corruption by randomly selecting a byte in the packet's linear data area and modifying it.

The core issue lies in the assumption that packets always have a non-zero linear data length. The function calculates a random index using get_random_u32_below(skb_headlen(skb)) to select which byte to corrupt. However, when dealing with fully non-linear packets (where all data resides in page fragments rather than the linear skb->data buffer), skb_headlen(skb) returns zero.

When zero is passed to get_random_u32_below(), the function's variable-ceiling slow path activates, returning an unconstrained 32-bit random integer instead of a value within valid bounds. This random value is then used as an offset to write into skb->data, causing an out-of-bounds memory access that can read or write kernel memory outside the allocated buffer.

Root Cause

The root cause is a missing boundary check in the packet corruption code path within netem_enqueue(). The function fails to verify that skb_headlen(skb) is non-zero before using it as the upper bound for random index generation. This oversight allows fully non-linear socket buffers to trigger undefined behavior in the random number generation function.

The vulnerability is specifically triggered when:

1. AF_PACKET with TX_RING mode is used to send packets
2. The packets are fully non-linear (zero-length linear data area)
3. The packets traverse an IPIP tunnel interface
4. The netem qdisc is configured with packet corruption enabled

Attack Vector

The attack requires local access to the system with the ability to create AF_PACKET sockets and configure network interfaces. An attacker would construct fully non-linear packets using TX_RING mode and send them over an interface with the netem qdisc attached and corruption enabled.

The exploitation flow involves:

1. Creating an AF_PACKET socket with TX_RING enabled
2. Setting up or utilizing an existing IPIP tunnel interface
3. Configuring the netem qdisc with packet corruption on the tunnel interface
4. Sending specially crafted fully non-linear packets through the tunnel
5. The kernel's corruption logic triggers an out-of-bounds memory access using an unconstrained random offset

The fix verifies that skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Packets that are fully non-linear will silently bypass the corruption logic, preventing the out-of-bounds access while maintaining the module's intended functionality for normal packets.

Detection Methods for CVE-2026-31675

Indicators of Compromise

• Kernel crash dumps or oops messages referencing netem_enqueue or sch_netem module
• Unexpected system instability when network emulation is active on IPIP tunnels
• Memory corruption indicators in kernel logs related to network qdisc operations

Detection Strategies

• Monitor for kernel oops or panic events involving the sch_netem module or netem_enqueue function
• Audit systems for netem qdisc configurations with corruption enabled, especially on tunnel interfaces
• Deploy kernel-level monitoring for out-of-bounds memory access attempts in network subsystem paths
• Review AF_PACKET socket usage patterns for potential exploitation attempts

Monitoring Recommendations

• Enable kernel auditing for qdisc configuration changes using tc commands
• Monitor for unusual AF_PACKET TX_RING socket creation by unprivileged processes
• Implement host-based intrusion detection rules for anomalous sch_netem behavior
• Deploy SentinelOne Singularity Platform for real-time kernel-level threat detection and memory protection

How to Mitigate CVE-2026-31675

Immediate Actions Required

• Apply the latest kernel security patches from your Linux distribution immediately
• If immediate patching is not possible, disable packet corruption in netem qdisc configurations
• Restrict access to AF_PACKET sockets using capabilities or network namespaces
• Audit and review any netem qdisc configurations on IPIP tunnel interfaces

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds a validation check to ensure skb_headlen(skb) is non-zero before proceeding with packet corruption logic. Fully non-linear packets will silently bypass the corruption functionality, eliminating the out-of-bounds access vector.

Patches are available in the following kernel git commits:

• Kernel Git Commit 13a66ca1
• Kernel Git Commit 3a299970
• Kernel Git Commit 4fd258e2
• Kernel Git Commit a14b5686
• Kernel Git Commit d64cb81d

Workarounds

• Disable the corrupt option in netem qdisc configurations until patches can be applied
• Remove sch_netem module from production systems if not actively required
• Restrict AF_PACKET socket creation using seccomp or capability restrictions
• Isolate network emulation testing environments from production infrastructure

# Remove netem qdisc with corruption from an interface
tc qdisc del dev ipip0 root netem

# Alternatively, reconfigure netem without corruption
tc qdisc change dev ipip0 root netem delay 100ms

# Blacklist sch_netem module if not needed
echo "blacklist sch_netem" >> /etc/modprobe.d/blacklist-netem.conf