CVE-2026-31503: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31503 is a Linux kernel vulnerability in the UDP socket bind conflict detection logic, specifically affecting the hash2 collision mechanism. When the number of sockets bound to a port exceeds 10, the kernel switches from hash to hash2 for collision detection, but fails to properly validate wildcard address bindings ([::], 0.0.0.0, ::ffff:0.0.0.0), allowing a socket to bind to a wildcard address that should be rejected. The vulnerability affects Linux kernel versions from 2.6.33 through 6.1.167, 6.2 through 6.6.130, 6.7 through 6.12.79, 6.13 through 6.18.20, and 6.19 through 6.19.10, as well as 7.0 release candidates. It was published on April 22, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, bugzilla.redhat.com).

The root cause is an incorrect or missing check of the return value / logic path in UDP's dual-hash bind conflict detection (CWE-253). The Linux kernel UDP subsystem uses two hash tables: hash (keyed by local port only) and hash2 (keyed by local address and local port). When hslot->count exceeds 10, the kernel switches to hash2, but the wildcard address check — which requires scanning all specific-address bindings on the same port — is not performed under hash2, allowing udp_lib_lport_inuse() to miss conflicts. The fix ports the correct logic from TCP's inet_csk_get_port() (renamed to inet_use_hash2_on_bind() and moved to inet_hashtables.h) into the UDP bind path so it is reused regardless of which hash mechanism is active (Github Advisory, bugzilla.redhat.com).

A local attacker or unprivileged process can successfully bind a UDP socket to a wildcard address ([::], 0.0.0.0, or ::ffff:0.0.0.0) on a port that is already in use by 11 or more specific-address sockets, bypassing the expected EADDRINUSE error. This breaks port isolation between applications, potentially allowing an unauthorized process to intercept or hijack UDP traffic intended for legitimate services. The primary impact is high availability disruption and potential integrity compromise through unauthorized port control; there is no direct confidentiality impact (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires local access with low privileges (e.g., a standard user account) and the precondition that more than 10 UDP sockets are already bound to the target port with distinct specific addresses. The EPSS score is approximately 0.015% (3rd percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Gain local access: Obtain a low-privileged local account or code execution on the target Linux system running a vulnerable kernel version.
2. Trigger hash2 mode: Ensure that at least 11 UDP sockets are bound to the target port (e.g., port 8888) with distinct specific addresses (e.g., [fd00::1]:8888 through [fd00::11]:8888), causing hslot->count to exceed 10 and switching the kernel to hash2 collision detection.
3. Bind wildcard socket: Attempt to bind a new UDP socket to the wildcard address on the same port (e.g., bind(fail_fd, "[::]:8888") or bind(fail_fd, "0.0.0.0:8888")). Due to the bug, this call succeeds instead of returning EADDRINUSE.
4. Intercept traffic: With the wildcard socket successfully bound, the attacker's socket may receive UDP datagrams intended for legitimate services on that port, enabling traffic interception or service disruption (Github Advisory, bugzilla.redhat.com).

• Logs: Kernel audit logs showing a bind() syscall succeeding on a wildcard address (0.0.0.0, ::, or ::ffff:0.0.0.0) for a port already occupied by 11+ specific-address UDP sockets without a corresponding EADDRINUSE error.
• Network: Unexpected UDP traffic being received by a process bound to a wildcard address on a port that should be exclusively used by specific-address services; use ss -ulnp or netstat -ulnp to identify unexpected wildcard bindings on high-use ports.
• Process: Unusual processes holding wildcard UDP socket bindings on ports normally reserved for specific-address services, detectable via ss -ulnp or /proc/net/udp6.

Apply the upstream Linux kernel patches available for the affected stable branches: fix commits are available at git.kernel.org for kernel versions targeting 6.1.168, 6.6.131, 6.12.80, 6.18.21, and 6.19.11. Amazon Linux 2023 users should apply ALAS2023-2026-1646 or ALAS2023-2026-1681, and SUSE users should apply SUSE-SU-202621834-1. As a temporary workaround, limit the number of concurrent UDP socket bindings on the same port to 10 or fewer, implement privilege restrictions to control which processes can create UDP sockets, and monitor for unexpected wildcard socket bindings using ss -ulnp (Github Advisory, bugzilla.redhat.com).