Skip to main content

Linux Kernel CVE-2026-31668

| EUVDEUVD-2026-25561 CRITICAL
2026-04-24 Linux GHSA-r2p4-96h8-cc74
Authentication Bypass Linux
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Low–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.4 MEDIUM

Network-triggered but requires niche SRv6-plus-VRF config and path-ordering (AC:H); impact is cross-context routing misdirection breaching isolation (S:C, C:L/I:L), not code execution or DoS.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
CRITICAL
qualitative
Red Hat
3.3 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:24 vuln.today
Patch released
Apr 27, 2026 - 20:08 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25561
CVE Published
Apr 24, 2026 - 14:45 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.

Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.

AnalysisAI

Routing policy bypass in the Linux kernel's IPv6 Segment Routing (SRv6) seg6 lwtunnel implementation allows post-encapsulation SID lookups to be resolved from a stale, shared destination cache. Kernels from 4.10 onward that deploy seg6 encap routes shared a single dst_cache between seg6_input_core() and seg6_output_core(); whichever path executed first populated the cache and the other reused it blindly, bypassing its own routing lookup (e.g. ip rules matching the ingress interface or VRF table separation). Despite an NVD-assigned CVSS of 9.8 and a 'Authentication Bypass' tag, this is a routing-correctness/isolation defect rather than memory corruption or code execution; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 7th percentile).

Technical ContextAI

The affected component is IPv6 Segment Routing (SRv6, RFC 8986) as implemented in the Linux kernel's lightweight tunnel (lwtunnel) subsystem - specifically net/ipv6/seg6_local and the seg6 encap route path. To avoid a full route lookup on every packet, each encap route caches the resolved next-hop dst in a dst_cache structure. The bug is that a single cache instance was shared across both the input processing path (seg6_input_core, packets being forwarded/decapsulated) and the output path (seg6_output_core, locally originated traffic). Because these two paths can legitimately resolve to different next-hops when policy routing depends on context that differs between them (fib rules keyed on the incoming interface, or separate VRF routing tables), a cache entry populated by one path is semantically invalid for the other. The fix splits the structure into cache_input and cache_output so each path maintains an independent cached dst. No CWE was assigned by NVD; the root-cause class is best described as improper cache/state sharing leading to a routing decision being made in the wrong context (broadly a CWE-668/CWE-923-style resource-isolation flaw), not a classic authentication-bypass CWE despite the vendor tag.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, or 6.19.13 or later, matching your kernel series. Distribution users should apply the corresponding vendor package update, for example via Ubuntu USN-8490-1 (https://ubuntu.com/security/notices/USN-8490-1) or the equivalent Red Hat/SUSE erratum, and reboot. If immediate patching is not possible, the most effective compensating control is to avoid or remove the vulnerable configuration: do not deploy seg6 lwtunnel encap routes on hosts that also rely on ingress-interface-based fib rules or VRF table separation for the same SRv6 traffic, since it is precisely that combination that triggers the incorrect cache reuse - the trade-off is loss of SRv6 policy/VRF flexibility on those nodes. Where SRv6 is not needed, ensure CONFIG_IPV6_SEG6_LWTUNNEL functionality is not in use. Fix commits for verification are on git.kernel.org (e.g. https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1).

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31668 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy