CVE-2026-31684

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network (VLAN) headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of service.

This vulnerability is rated as Moderate impact because exploiting it requires an administrator to explicitly configure a traffic control filter using the checksum recalculation action (act_csum), limiting exposure under default system configurations. In environments where this non-default queuing discipline action processes incoming traffic, an unauthenticated attacker could send packets with nested VLAN headers that trigger an out-of-bounds read in the linear socket buffer. This condition can lead to a denial of service through a kernel crash or potentially expose kernel memory, though general exposure is constrained by the prerequisite network setup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.