https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 10:40:10 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31684 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: sched: act_csum: validate nested VLAN headers</p> <p>tcf_csum_act() walks nested VLAN headers directly from skb-&gt;data when an skb still carries in-payload VLAN tags. The current code reads vlan-&gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.</p> <p>If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.</p> <p>Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: sched: act_csum: validate nested VLAN headers</p> <p>tcf_csum_act() walks nested VLAN headers directly from skb-&gt;data when an skb still carries in-payload VLAN tags. The current code reads vlan-&gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area.</p> <p>If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.</p> <p>Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.</p> https://vulnerability.circl.lu/vuln/cve-2026-31684