{"id":"CVE-2026-31675","title":"net/sched: sch_netem: fix out-of-bounds access in packet corruption","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to sele…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < a14b56863348686dd0387eea8ce66b85cf455908","Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 13a66ca1e235d4bcd53d12d4c68490cad7f8e46f","Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 3a2999704ac36cfb4041fed3652d26a3373e8d12","Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 4fd258e281fa8bc15e9ce2c7691941537e9258ad","Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < d64cb81dcbd54927515a7f65e5e24affdc73c14b","Linux 2.6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:12:12.570875Z"},"published":"2026-04-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:23.263Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31675","references":[{"url":"https://git.kernel.org/stable/c/a14b56863348686dd0387eea8ce66b85cf455908"},{"url":"https://git.kernel.org/stable/c/13a66ca1e235d4bcd53d12d4c68490cad7f8e46f"},{"url":"https://git.kernel.org/stable/c/3a2999704ac36cfb4041fed3652d26a3373e8d12"},{"url":"https://git.kernel.org/stable/c/4fd258e281fa8bc15e9ce2c7691941537e9258ad"},{"url":"https://git.kernel.org/stable/c/d64cb81dcbd54927515a7f65e5e24affdc73c14b"}],"tags":["cve.org"],"epss":0.00184,"epssPercentile":0.07435,"ingestedAt":"2026-10-16T17:24:46.670Z","slug":"CVE-2026-31675","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb->data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb->data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic.\n\n## Affected\n\n- `Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < a14b56863348686dd0387eea8ce66b85cf455908`\n- `Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 13a66ca1e235d4bcd53d12d4c68490cad7f8e46f`\n- `Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 3a2999704ac36cfb4041fed3652d26a3373e8d12`\n- `Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < 4fd258e281fa8bc15e9ce2c7691941537e9258ad`\n- `Linux >= c865e5d99e25a171e8262fc0f7ba608568633c64 < d64cb81dcbd54927515a7f65e5e24affdc73c14b`\n- `Linux 2.6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}