CVE-2026-31675

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_netem: fix out-of-bounds access in packet corruption

In netemenqueue(), the packet corruption logic uses getrandomu32below(skbheadlen(skb)) to select an index for modifying skb->data. When an AFPACKET TXRING sends fully non-linear packets over an IPIP tunnel, skbheadlen(skb) evaluates to 0.

Passing 0 to getrandomu32_below() takes the variable-ceil slow path which returns an unconstrained 32-bit random integer. Using this unconstrained value as an offset into skb->data results in an out-of-bounds memory access.

Fix this by verifying skb_headlen(skb) is non-zero before attempting to corrupt the linear data area. Fully non-linear packets will silently bypass the corruption logic.