CVE-2026-31675

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: sch_netem: fix out-of-bounds access in packet corruption<br /> <br /> In netem_enqueue(), the packet corruption logic uses<br /> get_random_u32_below(skb_headlen(skb)) to select an index for<br /> modifying skb-&gt;data. When an AF_PACKET TX_RING sends fully non-linear<br /> packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.<br /> <br /> Passing 0 to get_random_u32_below() takes the variable-ceil slow path<br /> which returns an unconstrained 32-bit random integer. Using this<br /> unconstrained value as an offset into skb-&gt;data results in an<br /> out-of-bounds memory access.<br /> <br /> Fix this by verifying skb_headlen(skb) is non-zero before attempting<br /> to corrupt the linear data area. Fully non-linear packets will silently<br /> bypass the corruption logic.