Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants. Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026042545-CVE-2026-31684-6974@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:21557 https://access.redhat.com/errata/RHSA-2026:21557
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:21556 https://access.redhat.com/errata/RHSA-2026:21556
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:21706 https://access.redhat.com/errata/RHSA-2026:21706
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:21745 https://access.redhat.com/errata/RHSA-2026:21745
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:40068 https://access.redhat.com/errata/RHSA-2026:40068
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:41234 https://access.redhat.com/errata/RHSA-2026:41234
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:41235 https://access.redhat.com/errata/RHSA-2026:41235
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:43231 https://access.redhat.com/errata/RHSA-2026:43231
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:44385 https://access.redhat.com/errata/RHSA-2026:44385
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:44694 https://access.redhat.com/errata/RHSA-2026:44694
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:47632 https://access.redhat.com/errata/RHSA-2026:47632
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:47633 https://access.redhat.com/errata/RHSA-2026:47633
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:47869 https://access.redhat.com/errata/RHSA-2026:47869
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:47739 https://access.redhat.com/errata/RHSA-2026:47739