Invalid MAC header access in Linux kernel netfilter ip6t_eui64 (CVE-2026-31685)

In the Linux kernel netfilter subsystem, the `eui64_mt6()` function in `ip6t_eui64` fails to reject packets with an invalid MAC header when `par->fragoff == 0`, allowing the code to reach `eth_hdr(skb)` without a valid MAC header present. The existing guard only applies when `par->fragoff != 0`, leaving non-fragmented packets unprotected. An attacker could possibly use this to compromise the system. Affected versions: - Ubuntu 25.10 We recommend updating to: linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18, linux-image-6.17.0-1019-aws 6.17.0-1019.19, linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19, linux-image-6.17.0-1020-gcp 6.17.0-1020.22, linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22, linux-image-6.17.0-40-generic 6.17.0-40.40. CVSS 9.4 · our assessment: act_now Reference: https://ubuntu.com/security/notices/USN-8490-1 Details: https://vuln.today/cve/CVE-2026-31685