{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"d6ace0dbcbb7fd285738bb87b42b71b01858c952","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"2297e38114316b26ae02f2d205c49b5511c5ed55","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"f1bed05a832ae79be5f7a105da56810eaa59a5f1","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"0a360f7f73a06ac88f18917055fbcc79694252d7","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"e537dd15d0d4ad989d56a1021290f0c674dd8b28","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"cveId":"CVE-2026-31503","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1,  \"[fd00::1]:8888\")\nbind(fd2,  \"[fd00::2]:8888\")\nbind(fd3,  \"[fd00::3]:8888\")\nbind(fd4,  \"[fd00::4]:8888\")\nbind(fd5,  \"[fd00::5]:8888\")\nbind(fd6,  \"[fd00::6]:8888\")\nbind(fd7,  \"[fd00::7]:8888\")\nbind(fd8,  \"[fd00::8]:8888\")\nbind(fd9,  \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\")      /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix.","epss":{"date":"2026-11-05","percentile":0.0224,"score":0.00125},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915103994,"publishedAt":1776866063221,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"remediation":[],"revision":"0402aec2ea908d4d577c3656ed046779c42ff9cf93a5b1b51479576f5e3c4013","sources":[{"modifiedAt":1793915103994,"name":"CNA: Linux","retrievedAt":1793917072622,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31503"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917073088,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31503"}],"ssvc":{"assessedAt":1793914564666,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"udp: Fix wildcard bind conflict check when using hash2","updatedAt":1793917073088}