CVE-2026-31700 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
A time-of-check time-of-use race condition in the Linux kernel's packet socket implementation allows local attackers to bypass security checks and potentially escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31700?
CVE-2026-31700 is a high-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent userspace thread can modify the vnet_hdr fields between validation and use, bypassing all safety checks.
The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr to a stack-local variable. All other vnet_hdr consumers in the kernel (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX path is the only caller of virtio_net_hdr_to_skb() that reads directly from user-controlled shared memory.
Fix this by copying vnet_hdr from the mmap'd ring buffer to a stack-local variable before validation and use, consistent with the approach used in packet_snd() and all other callers.
Which versions are affected by CVE-2026-31700?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31700?
Apply the vendor's patch.
Is CVE-2026-31700 being exploited?
There is no known exploitation of CVE-2026-31700 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85448, BELL-CVE-2026-31700, DEBIAN-CVE-2026-31700, GHSA-hxpw-4fhf-x5hx, ROOT-OS-DEBIAN-11-CVE-2026-31700, ROOT-OS-DEBIAN-12-CVE-2026-31700 and 3 more.