Linux Kernel CVE-2026-31531

The vulnerability requires: (1) local system access (network-based exploitation is not possible), (2) unprivileged user credentials (PR:L - low privilege sufficient), (3) a nexthop object configured with a large Equal-Cost Multi-Path group exceeding approximately 512 member nexthops (this is the critical trigger condition), and (4) capability to send RTM_GETNEXTHOP netlink messages, which standard users can perform. The vulnerability does NOT require root access, special kernel modules, or kernel configuration changes beyond standard ECMP routing setup. Systems using small nexthop groups (<512 members) or not using nexthop objects at all are not affected. The attack is reliable and reproducible once a large nexthop group exists; iproute2 tools cannot currently trigger this via normal commands due to built-in size limits, but the kernel API itself is vulnerable to direct netlink calls.

This is a low-to-moderate real-world risk despite the 5.5 CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) correctly indicates local-only attack surface requiring low-privilege user access, eliminating remote attack risk entirely. The extremely low EPSS score (0.02%, percentile 5%) reflects minimal exploitation probability, suggesting this is a niche impact affecting only systems managing large ECMP nexthop groups. No public exploit code exists, and no active exploitation is reported. However, the vulnerability is real for environments using advanced routing with large nexthop groups (>512 members), where local authenticated users can reliably trigger denial of service. The impact is availability-only (A:H) with no confidentiality or integrity compromise. Organizations should prioritize this based on whether they deploy ECMP routing with large group sizes and their tolerance for local DoS from untrusted users. The CVSS and EPSS signals align: high individual impact but low operational likelihood.

A local authenticated user with unprivileged credentials (e.g., a system service or user account) sends an RTM_GETNEXTHOP netlink message querying a nexthop group containing more than approximately 512 members. The kernel's fixed-size socket buffer (NLMSG_GOODSIZE) overflows during serialization of the large group data, triggering a kernel warning and potentially causing a kernel panic or system hang depending on kernel configuration and memory pressure, resulting in denial of service.