TOCTOU race in Linux kernel net/packet tpacket_snd() mmap'd vnet_hdr handling

CVE-2026-31700 is a local Linux kernel vulnerability in the net/packet subsystem, specifically the AF_PACKET TPACKET transmit path in tpacket_snd() when PACKET_VNET_HDR is enabled. In the vulnerable path, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel first validates the virtio network header via __packet_snd_vnet_parse(), but later re-reads the header fields in virtio_net_hdr_to_skb() from the same user-controlled shared memory. Because the header is not copied to stable kernel memory before both operations, a concurrent userspace thread can modify vnet_hdr fields after validation but before use, creating a time-of-check to time-of-use race that bypasses the intended safety checks. The upstream fix copies vnet_hdr from the mmap'd ring buffer into a stack-local variable before validation and use, matching the already-safe behavior in packet_snd() and other kernel consumers such as tun.c, tap.c, and virtio_net.c.