Linux Kernel CVE-2026-31675

Exploitation requires: (1) the netem (sch_netem) qdisc configured with the packet corruption feature enabled ('tc qdisc netem corrupt'), which needs CAP_NET_ADMIN in the relevant network namespace; (2) traffic sent via an AF_PACKET socket using a TX_RING that produces fully non-linear (zero linear-header) skbs; and (3) that traffic traversing an IPIP tunnel device so skb_headlen(skb) evaluates to 0. Limiting factors: it is local-only (no network-remote trigger), requires privileged qdisc configuration (CAP_NET_ADMIN), and depends on a non-default, multi-component stack (netem corruption + AF_PACKET TX_RING + IPIP) that is essentially never present in default deployments - it is primarily a lab/testing configuration. These constraints make real-world exposure far narrower than the CVSS AC:L rating suggests.

The signals converge on 'real bug, low operational urgency.' The supplied CVSS is 7.8 High (AV:L/AC:L/PR:L/UI:N with C:H/I:H/A:H), but that vector understates the preconditions and overstates confidentiality/integrity: exploitation is not simple (AC:L is questionable) because it requires a specific stacked configuration - a netem qdisc with corruption enabled, AF_PACKET TX_RING traffic, and IPIP encapsulation - and the primary realistic outcome of a wild out-of-bounds offset is a kernel panic (DoS) rather than reliable code execution. EPSS is 0.02% (5th percentile), the CVE is NOT in CISA KEV, and no SSVC decision data or POC is provided, all consistent with negligible active-exploitation likelihood. Configuring a netem qdisc requires CAP_NET_ADMIN, so this is a privileged-local issue; the main concern is untrusted network namespaces where an unprivileged user may hold CAP_NET_ADMIN inside a user namespace. Net: patch in normal maintenance cycles; not an emergency. Note the conflict: CVSS marks C:H/I:H/A:H but the mechanism (single-byte XOR at a random offset) argues for low confidentiality/integrity and high availability impact - verify impact classification against the actual code path.

A local user with CAP_NET_ADMIN (including inside an unprivileged user namespace on a misconfigured host, or a low-trust tenant on a shared box) attaches a netem qdisc with corruption enabled to an interface, then transmits fully non-linear packets via an AF_PACKET TX_RING socket routed through an IPIP tunnel. Because skb_headlen is 0, the kernel indexes skb->data at an unconstrained random offset, corrupting out-of-bounds memory and typically panicking the machine (local denial of service). No public exploit code is identified at time of analysis, and the specific multi-component setup makes reliable exploitation for anything beyond a crash difficult.