Loading story…
A Linux kernel flaw tracked as CVE-2026-31684 was disclosed in the network scheduler's act_csum code, where improperly validated nested VLAN headers can trigger an out-of-bounds read. The bug affects tcf_csum_act() in net/sched/act_csum.c, which may access h_vlan_encapsulated_proto and pull VLAN_HLEN bytes from skb->data before confirming the full VLAN header is present in the linear buffer, breaking skb invariants and potentially crashing the system.
The issue was introduced in kernel 5.1, with an additional affected introduction point noted in 4.19.99, and has been fixed upstream in 6.12.83, 6.18.24, 6.19.14, and 7.0. Red Hat rated the vulnerability Moderate with a CVSS v3 score of 7.1 and published fixes for multiple Red Hat Enterprise Linux kernel packages across RHEL 7, 8, and 10 through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-28, Red Hat issued RHSA-2026:21557 for RHEL 10, RHSA-2026:21745 for RHEL 8 kernel-rt, and RHSA-2026:21706 for RHEL 8 kernel to address CVE-2026-31684.
Red Hat published its CVE-2026-31684 entry on 2026-04-25, classifying the Linux kernel flaw as Moderate severity and describing a denial-of-service risk from specially crafted packets with nested VLAN headers.
On 2026-04-25, the Linux kernel CVE team published an announcement for CVE-2026-31684, describing an out-of-bounds read issue in net/sched/act_csum.c related to nested VLAN headers. The advisory recommended updating to the latest stable kernel release rather than cherry-picking individual commits.
On 2026-07-30, Red Hat issued RHSA-2026:47633 for the RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages to address CVE-2026-31684.
On 2026-07-23, Red Hat issued RHSA-2026:44694 for Red Hat Enterprise Linux 10.0 Extended Update Support to fix CVE-2026-31684.
On 2026-07-17, Red Hat issued RHSA-2026:41234 for RHEL 7 Extended Lifecycle Support kernel-rt and RHSA-2026:41235 for RHEL 7 Extended Lifecycle Support kernel to address CVE-2026-31684.
On 2026-07-15, Red Hat issued RHSA-2026:40068 for the RHEL 8.6 support streams to fix CVE-2026-31684.
The Linux kernel fixed CVE-2026-31684 in versions 6.12.83, 6.18.24, 6.19.14, and 7.0 by adding validation to ensure each nested VLAN header is fully present before access and pull operations. The fix drops packets through the existing error path when the header is still not fully available.
The nested VLAN header validation flaw later tracked as CVE-2026-31684 was introduced in Linux kernel 5.1. The Linux kernel CVE advisory also notes an additional introduction point in 4.19.99.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026