CVE-2026-31684

In the Linux kernel, the following vulnerability has been resolved:

net: sched: act_csum: validate nested VLAN headers

tcfcsumact() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->hvlanencapsulatedproto and then pulls VLANHLEN bytes without first ensuring that the full VLAN header is present in the linear area.

If only part of an inner VLAN header is linearized, accessing hvlanencapsulatedproto reads past the linear area, and the following skbpull(VLAN_HLEN) may violate skb invariants.

Fix this by requiring pskbmaypull(skb, VLAN_HLEN) before accessing and pulling each nested VLAN header. If the header still is not fully available, drop the packet through the existing error path.