CVE-2026-31675

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_netem: fix out-of-bounds access in packet corruption

In netem_enqueue(), the packet corruption logic uses

get_random_u32_below(skb_headlen(skb)) to select an index for

modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear

packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.

Passing 0 to get_random_u32_below() takes the variable-ceil slow path

which returns an unconstrained 32-bit random integer. Using this

unconstrained value as an offset into skb->data results in an

out-of-bounds memory access.

Fix this by verifying skb_headlen(skb) is non-zero before attempting

to corrupt the linear data area. Fully non-linear packets will silently

bypass the corruption logic.