Vulnerability in Linux Kernel Affecting Nested VLAN Header Handling

CVE-2026-31684

What is CVE-2026-31684?

A vulnerability in the Linux kernel's handling of nested VLAN headers can allow for improper packet validation. The function tcf_csum_act() does not adequately verify that the entire VLAN header is present when processing in-payload VLAN tags. This oversight can lead to excessive memory access beyond the linear area of a socket buffer (skb) when the inner VLAN header is not fully linearized. The fix ensures that necessary checks are in place by requiring proper validation of the skb before attempting to access and pull nested VLAN headers, preventing potential integrity violations in the network packet processing. If the header is not fully available, the packet is discarded through the existing error handling path.

References