CVE-2026-31675: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31675 Overview

CVE-2026-31675 is a high-severity out-of-bounds memory access vulnerability in the Linux kernel's network emulation queueing discipline (sch_netem). The flaw resides in the netem_enqueue() function, where the packet corruption logic invokes get_random_u32_below(skb_headlen(skb)) to choose an index for modifying skb->data. When skb_headlen(skb) returns zero, the call returns an unconstrained 32-bit random integer that is then used as an offset into the socket buffer's linear data area. The condition is reachable when an AF_PACKETTX_RING sender transmits fully non-linear packets over an IPIP tunnel. The vulnerability is tracked under CWE-125.

Critical Impact
A local attacker with the ability to send crafted packets through a netem-enabled interface can trigger an out-of-bounds memory access, potentially leading to kernel memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel 7.0-rc1 through 7.0-rc6
Linux kernel stable branches prior to the fix commits
Systems using the sch_netem queueing discipline with AF_PACKETTX_RING over IPIP tunnels

Discovery Timeline

2026-04-25 - CVE-2026-31675 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31675

Vulnerability Analysis

The sch_netem module implements a network emulator queueing discipline used to simulate packet loss, delay, duplication, and corruption for testing. Inside netem_enqueue(), the packet corruption code path randomly selects a byte within the linear portion of the socket buffer and flips a bit to simulate transmission errors.

The implementation calls get_random_u32_below(skb_headlen(skb)) to pick an index. The get_random_u32_below() helper has a documented edge case: when passed zero, it falls through to the variable-ceil slow path and returns an unconstrained 32-bit random integer rather than a bounded value. The kernel network stack uses this unbounded value as an index into skb->data, resulting in a read or write far outside the legitimate buffer.

Root Cause

The root cause is the absence of a zero-length check before invoking the random index helper. Most socket buffers carry data in the linear area, so skb_headlen(skb) is typically non-zero. However, AF_PACKETTX_RING constructs fully non-linear skbs by placing user-supplied payload entirely into paged fragments. When such an skb traverses an IPIP tunnel, the linear header area can remain empty, making skb_headlen(skb) evaluate to zero on entry to the netem corruption logic.

Attack Vector

Exploitation requires local access on a host where an administrator has attached the sch_netem qdisc to a network interface with a non-zero corruption probability. An unprivileged process can open an AF_PACKET socket with PACKET_TX_RING, build non-linear frames, and transmit them through an IPIP tunnel attached to the netem-enabled device. Each such packet that hits the corruption branch causes an out-of-bounds access against kernel memory, potentially corrupting adjacent allocations or triggering a panic.

No public exploit or proof-of-concept code is available at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS exploitation probability is currently 0.013%.

Detection Methods for CVE-2026-31675

Indicators of Compromise

Unexpected kernel oops or panic messages referencing netem_enqueue, sch_netem, or skb_headlen in dmesg and /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads or writes within the netem code path
Unexplained network interface resets or qdisc errors on systems with tc qdisc netem configurations

Detection Strategies

Audit systems for active sch_netem qdiscs using tc qdisc show and confirm whether the corrupt parameter is enabled
Enable KASAN on test kernels and replay AF_PACKET TX_RING traffic over IPIP tunnels to validate exposure
Monitor kernel ring buffer for BUG: or general protection fault entries containing netem symbols

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM solution and alert on stack traces involving netem_enqueue
Track creation of AF_PACKET sockets with PACKET_TX_RING by unprivileged users via auditd rules on the socket and setsockopt syscalls
Inventory hosts running affected Linux kernel 7.0 release candidates and prioritize them for patching

How to Mitigate CVE-2026-31675

Immediate Actions Required

Apply the upstream stable kernel patches that add the skb_headlen(skb) non-zero check before invoking the corruption logic
Disable the netem corruption feature on production interfaces by removing the corrupt parameter from active tc qdisc configurations
Restrict unprivileged access to AF_PACKET sockets by setting kernel.unprivileged_bpf_disabled=1 and reviewing CAP_NET_RAW assignments

Patch Information

The Linux kernel maintainers have merged fixes across multiple stable branches. The patch verifies that skb_headlen(skb) is non-zero before attempting to modify the linear data area, allowing fully non-linear packets to bypass the corruption logic silently. Relevant commits include Kernel Git Commit 13a66ca, Kernel Git Commit 3a29997, Kernel Git Commit 4fd258e, Kernel Git Commit a14b568, and Kernel Git Commit d64cb81.

Workarounds

Remove netem corrupt action from all qdiscs where it is not strictly required for testing
Avoid stacking netem qdiscs above IPIP or other tunnel interfaces in production environments
Use user namespace restrictions and seccomp profiles to limit AF_PACKET socket creation by untrusted workloads

bash

# Inspect active netem qdiscs and remove corruption parameter
tc qdisc show | grep netem
tc qdisc replace dev eth0 root netem delay 100ms loss 1%
# Restrict AF_PACKET access via sysctl
sysctl -w kernel.unprivileged_bpf_disabled=1