High 7.8Published May 1, 2026

CVE-2026-31700net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

Updated under an hour ago (Oct 27, 2026, 7:50 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent userspace thread can modify the vnet_hdr fields between validation and use, bypassing all safety checks. The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr to a stack-local variable. All other vnet_hdr consumers in the kernel (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX path is the only caller of virtio_net_hdr_to_skb() that reads directly from user-controlled shared memory. Fix this by copying vnet_hdr from the mmap'd ring buffer to a stack-local variable before validation and use, consistent with the approach used in packet_snd() and all other callers.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-367
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	1d036d25e5609ba73fee6a88db01c306b140d512 builds before 0f4c9754956b86de158a4af5278c5cf5bda9439e; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 714aa973da8163925eda7efd49361ccbee21ee46; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 1490f82353bdabc09265a74e645b07f05cf4188e; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 3a1bf9116ea31470b89692585c3910dfe830dcdd; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 28324a3b62d9ce7f9bdd65a8ce63f382041d1b27; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b; from 1d036d25e5609ba73fee6a88db01c306b140d512 before 2c054e17d9d41f1020376806c7f750834ced4dc5	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.6 before 6.6.136; from 6.7 before 6.12.84; from 6.13 before 6.18.25; from 6.19 before 7.0.2; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/0f4c9754956b86de158a4af5278c5cf5bda9439e
https://git.kernel.org/stable/c/714aa973da8163925eda7efd49361ccbee21ee46
https://git.kernel.org/stable/c/1490f82353bdabc09265a74e645b07f05cf4188e
https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121	patch
https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcdd	patch
https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27	patch
https://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b	patch
https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.