CVE-2026-31684: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31684 is a missing buffer validation vulnerability in the Linux kernel's network scheduler act_csum module that can allow a local attacker to trigger a kernel crash (denial of service). The flaw exists in the tcf_csum_act() function, which processes nested VLAN headers without first verifying that the full VLAN header is present in the linear buffer area. It affects Linux kernel versions from 5.1 up to (but not including) 6.6.136, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0 release candidates (rc1–rc7). It was published on April 25, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). In tcf_csum_act(), the code walks nested VLAN headers directly from skb->data when an skb carries in-payload VLAN tags, reading vlan->h_vlan_encapsulated_proto and then calling skb_pull(VLAN_HLEN) without first calling pskb_may_pull(skb, VLAN_HLEN) to ensure the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, the read of h_vlan_encapsulated_proto goes past the linear area, and the subsequent skb_pull may violate skb invariants, leading to memory corruption or a kernel crash. The fix requires pskb_may_pull(skb, VLAN_HLEN) before each nested VLAN header access, dropping the packet via the existing error path if the header is unavailable (GitHub Advisory).

Successful exploitation results in a kernel crash, causing a complete denial of service on the affected system. The impact is limited to availability (high), with no confidentiality or integrity impact. An attacker with local access and low privileges can send crafted network packets with malformed nested VLAN headers to trigger the crash, potentially disrupting all services running on the affected host (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (GitHub Advisory). The vulnerability requires local access with low privileges (e.g., a local user or container with network capabilities), limiting its remote exploitability. The EPSS score is approximately 0.015–0.018%, indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Update the Linux kernel to a patched version: 6.6.136 or later (for the 5.1–6.6 branch), 6.12.83 or later (for the 6.7–6.12 branch), 6.18.24 or later (for the 6.13–6.18 branch), 6.19.14 or later (for the 6.19 branch), or 7.0 stable when released. Red Hat has issued security errata (RHSA-2026:21556, RHSA-2026:21557, RHSA-2026:21706, RHSA-2026:21745) and SUSE has released updates (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) (Red Hat Errata, SUSE Advisory). As a workaround, restrict network access to systems where untrusted VLAN traffic may reach the kernel's network scheduler, or unload/disable the act_csum kernel module if it is not required for network operations (GitHub Advisory).

The vulnerability was disclosed via the Linux kernel CVE announcement mailing list and quickly picked up by major Linux distribution vendors including Red Hat, SUSE, AlmaLinux, and Oracle Linux, all of which issued security errata shortly after disclosure (Red Hat Errata, SUSE Advisory). No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking and scanner detection updates.