CVE-2026-31700
published 2026-05-01CVE-2026-31700: In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.10%
1.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points
directly into the mmap'd TX ring buffer shared with userspace. The
kernel validates the header via __packet_snd_vnet_parse() but then
re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent
userspace thread can modify the vnet_hdr fields between validation
and use, bypassing all safety checks.
The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr
to a stack-local variable. All other vnet_hdr consumers in the kernel
(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX
path is the only caller of virtio_net_hdr_to_skb() that reads directly
from user-controlled shared memory.
Fix this by copying vnet_hdr from the mmap'd ring buffer to a
stack-local variable before validation and use, consistent with the
approach used in packet_snd() and all other callers.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 0f4c9754956b86de158a4af5278c5cf5bda9439e | 0f4c9754956b86de158a4af5278c5cf5bda9439e |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 714aa973da8163925eda7efd49361ccbee21ee46 | 714aa973da8163925eda7efd49361ccbee21ee46 |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 1490f82353bdabc09265a74e645b07f05cf4188e | 1490f82353bdabc09265a74e645b07f05cf4188e |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121 | 74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121 |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 3a1bf9116ea31470b89692585c3910dfe830dcdd | 3a1bf9116ea31470b89692585c3910dfe830dcdd |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 28324a3b62d9ce7f9bdd65a8ce63f382041d1b27 | 28324a3b62d9ce7f9bdd65a8ce63f382041d1b27 |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b | 48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b |
| linux | linux | >= 1d036d25e5609ba73fee6a88db01c306b140d512 < 2c054e17d9d41f1020376806c7f750834ced4dc5 | 2c054e17d9d41f1020376806c7f750834ced4dc5 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.6 < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.25 | 6.18.25 |
| linux | linux_kernel | >= 6.19 < 7.0.2 | 7.0.2 |
| linux | linux_kernel | >= 6.7 < 6.12.84 | 6.12.84 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 2.0
CVE-2026-46009 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drive
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 2.0
CVE-2026-46316 [LOW] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01·CVSS 2.0
CVE-2026-46042 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Rados block device (RBD) driver;
- Compressed RAM block device driver;
- Character device driver;
- TPM device driver;
- Hardware crypto device drivers;
- EDAC drivers;
- GPU drivers;
- Greybus drivers;
- HID
Red Hat
kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-31700 [MEDIUM] CWE-367 kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
A flaw was found in the Linux kernel. A Time-of-check to Time-of-use (TOCTOU) race condition exists in the `tpacket_snd()` function when `PACKET_VNET_HDR` is enabled. A local user can exploit this by modifying the `vnet_hdr` fields in the mmap'd TX ring buffer between validation and use, thereby bypassing safety checks. This could allow a local attacker to achieve a security bypass.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Ent
VulDB
Linux Kernel up to 6.6.135/6.12.83/6.18.24/7.0.1 tpacket_snd toctou (Nessus ID 317729 / WID-SEC-2026-1346)
vuldb·2026-06-20·CVSS 7.8
CVE-2026-31700 [HIGH] Linux Kernel up to 6.6.135/6.12.83/6.18.24/7.0.1 tpacket_snd toctou (Nessus ID 317729 / WID-SEC-2026-1346)
A vulnerability was found in Linux Kernel up to 6.6.135/6.12.83/6.18.24/7.0.1 and classified as critical. This affects the function tpacket_snd. The manipulation results in time-of-check time-of-use.
This vulnerability was named CVE-2026-31700. The attack needs to be approached within the local network. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
GHSA-hxpw-4fhf-x5hx: In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd()
ghsa_unreviewed·2026-05-01
CVE-2026-31700 [HIGH] CWE-362 GHSA-hxpw-4fhf-x5hx: In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd()
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points
directly into the mmap'd TX ring buffer shared with userspace. The
kernel validates the header via __packet_snd_vnet_parse() but then
re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent
userspace thread can modify the vnet_hdr fields between validation
and use, bypassing all safety checks.
The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr
to a stack-local variable. All other vnet_hdr consumers in the kernel
(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX
path is the only caller of virtio_net_hdr_to_skb() that reads directly
from user-cont
No detection rules found.
No public exploits indexed.
Rapid7
Patch Tuesday - May 2026
blogs_rapid7·2026-05-13·CVSS 10.0
CVE-2026-41089 [CRITICAL] Patch Tuesday - May 2026
Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above.
## Windows Netlogon: critical RCE
Anyone responsible for securing a domain controller should prioritize remediation of CVE-2026-41089 , which is a critical stack-based buffer overflow in Windows Netlogon with a CVSS v3 base score of 9.8. Exploitation leads to execution in the context of the Netlogon service, so that’s SYSTEM privileges on the domain controller. For most pentesters, that’s the point at which the customer report more or less writes itself. No privileges
Bugzilla
CVE-2026-31700 kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
bugzilla·2026-05-01
CVE-2026-31700 [MEDIUM] CVE-2026-31700 kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
CVE-2026-31700 kernel: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points
directly into the mmap'd TX ring buffer shared with userspace. The
kernel validates the header via __packet_snd_vnet_parse() but then
re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent
userspace thread can modify the vnet_hdr fields between validation
and use, bypassing all safety checks.
The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr
to a stack-local variable. All other vnet_hdr consumers in the kernel
(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET
https://git.kernel.org/stable/c/0f4c9754956b86de158a4af5278c5cf5bda9439ehttps://git.kernel.org/stable/c/1490f82353bdabc09265a74e645b07f05cf4188ehttps://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcddhttps://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804bhttps://git.kernel.org/stable/c/714aa973da8163925eda7efd49361ccbee21ee46https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121
2026-05-01
Published