CVE-2026-31700

In the Linux kernel, the following vulnerability has been resolved:

net/packet: fix TOCTOU race on mmap'd vnethdr in tpacketsnd()

In tpacketsnd(), when PACKETVNETHDR is enabled, vnethdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packetsndvnetparse() but then re-reads all fields later in virtionethdrtoskb(). A concurrent userspace thread can modify the vnethdr fields between validation and use, bypassing all safety checks.

The non-TPACKET path (packetsnd()) already correctly copies vnethdr to a stack-local variable. All other vnethdr consumers in the kernel (tun.c, tap.c, virtionet.c) also use stack copies. The TPACKET TX path is the only caller of virtionethdrtoskb() that reads directly from user-controlled shared memory.

Fix this by copying vnethdr from the mmap'd ring buffer to a stack-local variable before validation and use, consistent with the approach used in packetsnd() and all other callers.