CVE-2026-31700

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points

directly into the mmap'd TX ring buffer shared with userspace. The

kernel validates the header via __packet_snd_vnet_parse() but then

re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent

userspace thread can modify the vnet_hdr fields between validation

and use, bypassing all safety checks.

The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr

to a stack-local variable. All other vnet_hdr consumers in the kernel

(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX

path is the only caller of virtio_net_hdr_to_skb() that reads directly

from user-controlled shared memory.

Fix this by copying vnet_hdr from the mmap'd ring buffer to a

stack-local variable before validation and use, consistent with the

approach used in packet_snd() and all other cal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References