VulnerabilityPublished 22 Apr 2026Updated 5 Nov 2026

CVE-2026-31503: Linux kernel · udp: Fix wildcard bind conflict check when using hash2

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f1bed05a832ae79be5f7a105da56810eaa59a5f1 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f1bed05a832ae79be5f7a105da56810eaa59a5f1, e537dd15d0d4ad989d56a1021290f0c674dd8b28, d6ace0dbcbb7fd285738bb87b42b71b01858c952 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < f1bed05a832ae79be5f7a105da56810eaa59a5f1	Fixed in f1bed05a832ae79be5f7a105da56810eaa59a5f1
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < e537dd15d0d4ad989d56a1021290f0c674dd8b28	Fixed in e537dd15d0d4ad989d56a1021290f0c674dd8b28
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < d6ace0dbcbb7fd285738bb87b42b71b01858c952	Fixed in d6ace0dbcbb7fd285738bb87b42b71b01858c952
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < 2297e38114316b26ae02f2d205c49b5511c5ed55	Fixed in 2297e38114316b26ae02f2d205c49b5511c5ed55
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < 18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4	Fixed in 18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4
LinuxLinux	Affected ≥ 30fff9231fad757c061285e347b33c5149c2c2e4, < 0a360f7f73a06ac88f18917055fbcc79694252d7	Fixed in 0a360f7f73a06ac88f18917055fbcc79694252d7

AI-suggested

A fix is available and has been applied in the Linux kernel source code as indicated by the fixed commit hashes. Users should update their Linux kernel to a version that includes these fixes to resolve the issue. No additional mitigation steps are indicated or required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's UDP socket binding logic allows a wildcard bind conflict check to be bypassed when using the secondary hash table (hash2) for collision detection. This occurs when more than 10 sockets are bound to different local addresses but the same port, causing the kernel to switch to hash2, which can miss conflicts with wildcard addresses. This affects both IPv6 and IPv4 wildcard addresses, potentially allowing multiple sockets to bind to the same port unexpectedly.

Impact

This vulnerability can cause the Linux kernel to incorrectly allow multiple UDP sockets to bind to the same port when one uses a wildcard address and others use specific local addresses. This could lead to unexpected socket binding behavior, potentially causing application conflicts or denial of service due to port collisions not being detected properly. There is no indication of remote code execution or privilege escalation from the provided data.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 22:18 UTC

Technical details

References

Community reviews

Related threats