Skip to content
Heist/ feed
Unrated

udp: Fix wildcard bind conflict check when using hash2

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10. "hash2" is keyed by local address and local port. "hash" is keyed by local port only. The issue can be shown in the following bind sequence (pseudo code): bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888") bind(fd10, "[fd00::10]:8888") /* Correctly return -EADDRINUSE because "hash" is used * instead of "hash2". udp_lib_lport_inuse() detects the * conflict. */ bind(fail_fd, "[::]:8888") /* After one more socket is bound to "[fd00::11]:8888", * hslot->count exceeds 10 and "hash2" is used instead. */ bind(fd11, "[fd00::11]:8888") bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */ The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10. TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename i

Announced Source revision 1
Original source ↗

CVE-2026-31503

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31503

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "d6ace0dbcbb7fd285738bb87b42b71b01858c952",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "2297e38114316b26ae02f2d205c49b5511c5ed55",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "f1bed05a832ae79be5f7a105da56810eaa59a5f1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "0a360f7f73a06ac88f18917055fbcc79694252d7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30fff9231fad757c061285e347b33c5149c2c2e4",
        "lessThan": "e537dd15d0d4ad989d56a1021290f0c674dd8b28",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/net/inet_hashtables.h",
      "net/ipv4/inet_connection_sock.c",
      "net/ipv4/udp.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.33"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.33",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.168",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.131",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.80",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.21",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.11",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/net/inet_hashtables.h",
      "net/ipv4/inet_connection_sock.c",
      "net/ipv4/udp.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31503

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#28286 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement