Linux Kernel CVE-2026-31684

The act_csum module (net/sched/act_csum.c) is a Linux Traffic Control (tc) action that recomputes layer-4 checksums (TCP, UDP, ICMP) on packets matched by a tc classifier. When a packet carries in-payload VLAN tags (i.e., VLAN headers that have not been stripped into skb metadata by hardware or the kernel receive path), tcf_csum_act() walks nested VLAN headers by dereferencing a pointer into skb->data to read vlan->h_vlan_encapsulated_proto, then calls skb_pull(VLAN_HLEN) to advance past that header. Critically, this is done without first calling pskb_may_pull(skb, VLAN_HLEN) to guarantee the full VLAN header is present in the skb linear area. If only a fragment of an inner VLAN header is linearized - which can occur with GRO, GSO, or certain receive paths - the dereference reads past the linear area into skb frags, constituting an out-of-bounds read. The subsequent skb_pull() then violates skb invariants, which can lead to a kernel panic or crash. The CWE is not formally assigned in the input, but the root cause class is missing bounds check / improper input validation (analogous to CWE-20 or CWE-125). The fix, present in multiple stable-tree commits at git.kernel.org, adds pskb_may_pull(skb, VLAN_HLEN) before each nested VLAN header access, dropping the packet via the existing error path if the pull fails. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux kernel versions.