Junglewise Threat Intelligence

CVE-2026-31503: Linux Kernel UDP wildcard bind conflict bypass in hash2

CVE-2026-31503 · Severity: medium · CVSS 5.5 · Published 2026-04-22

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to bypass certain network port binding restrictions. Specifically, the system may fail to detect when multiple applications try to use the same UDP port if a large number of connections are already active. This could lead to unexpected network behavior or service disruptions on affected systems, including certain industrial controllers.

Technical details

A logic error exists in the Linux kernel's UDP protocol implementation (net/ipv4/udp.c) regarding how it handles port collision detection. When more than 10 sockets are bound to a specific port (hslot->count > 10), the kernel switches from using 'hash' (keyed by port) to 'hash2' (keyed by address and port) for performance. However, the 'hash2' check fails to properly account for wildcard addresses (0.0.0.0 or ::), allowing a socket to bind to a wildcard address even if the port is already in use by specific IP addresses. This bypasses the expected -EADDRINUSE error. The fix involves ensuring the kernel correctly identifies wildcard bind attempts and uses the appropriate hash table logic to detect conflicts. Patches have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel All versions prior to fix (e.g., 6.1, 6.6, 6.8)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-19: disclosed: Initial patch submission by Martin KaFai Lau
  • 2026-04-02: patched: Commits merged into stable kernel trees
  • 2026-04-22: advisory: CVE-2026-31503 published

References

Related threats