Skip to main content

Linux Kernel CVE-2026-31674

| EUVDEUVD-2026-25641 HIGH
2026-04-25 Linux
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local rule installation needs CAP_NET_ADMIN (obtainable via user namespace) so PR:L/AV:L; OOB read leaks kernel memory (C:H) and can crash the host (A:H) with no integrity change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:15 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25641
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()

Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.

rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value.

AnalysisAI

Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).

Technical ContextAI

The affected code is the netfilter xt_match module ip6t_rt, which implements matching on the IPv6 Routing Header (Type 0/2) inside Xtables (ip6tables). The rt match structure carries an addrnr counter describing how many addresses in rtinfo->addrs[] should be compared. The runtime matcher rt_mt6() trusted addrnr to remain within the fixed IP6T_RT_HOPS-sized array, but the rule-install checker rt_mt6_check() did not validate it, so a rule specifying an oversized addrnr caused an out-of-bounds array read during packet matching - a CWE-125 (Out-of-bounds Read) class flaw, despite the CWE being listed as N/A in the feed. The fix adds bounds validation of addrnr at rule installation time so malformed rules are rejected before rt_mt6() ever uses the value.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or mainline 7.0 (or your distribution's rebased equivalent). Ubuntu users should apply USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot; Siemens product operators should follow SSA-019113 and SSA-082556. If immediate patching is not possible, reduce exposure by restricting who can install netfilter rules: avoid granting CAP_NET_ADMIN to untrusted users, and set the sysctl user.max_user_namespaces=0 (or kernel.unprivileged_userns_clone=0 on distros that support it) to block unprivileged user-namespace creation - note this can break rootless containers and sandboxing tools that legitimately rely on user namespaces. Where the ip6t_rt match is not needed, unloading/blacklisting the ip6t_rt module removes the vulnerable code path, at the cost of losing IPv6 Routing Header rule matching.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31674 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy