CVE-2026-31700

A flaw was found in the Linux kernel. A Time-of-check to Time-of-use (TOCTOU) race condition exists in the tpacket_snd() function when PACKET_VNET_HDR is enabled. A local user can exploit this by modifying the vnet_hdr fields in the mmap'd TX ring buffer between validation and use, thereby bypassing safety checks. This could allow a local attacker to achieve a security bypass.

A TOCTOU existed between mmap'd vnet_hdr and tpacket_snd() for AF_PACKET TX. Red Hat advises patched kernels for workloads using packet mmap/TPACKET; unloading af_packet is a coarse mitigation where policy allows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the af_packet module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.