Skip to main content

Linux Kernel CVE-2026-31679

| EUVDEUVD-2026-25646 HIGH
2026-04-25 Linux
Information Disclosure Linux
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Attack is local Netlink flow programming requiring CAP_NET_ADMIN (AV:L, PR:L, AC:L); out-of-bounds read leaks kernel memory (C:H) and can crash the datapath (A:H), with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:13 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25646
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: validate MPLS set/set_masked payload length

validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls).

Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes.

Reject invalid MPLS action payload lengths early.

AnalysisAI

Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.

Technical ContextAI

The flaw is in the OVS kernel datapath (net/openvswitch), which processes flow-action attributes passed from userspace over Netlink. When a flow specifies a SET or SET_MASKED action rewriting an MPLS label, OVS action handling dereferences the payload as a fixed-layout struct ovs_key_mpls. The validation routine validate_set() failed to enforce that the OVS_KEY_ATTR_MPLS attribute length matched the expected fixed key size (including the masked case, where key_len is already normalized), allowing malformed short/long payloads to reach action code. This is a classic missing input-length-validation / out-of-bounds access class (functionally CWE-125 out-of-bounds read; the intelligence tags it as Information Disclosure), even though the NVD CWE field is listed as N/A. The fix uses the already normalized key_len and rejects non-matching MPLS action key sizes early. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel and its stable branches.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or mainline 7.0 (or later on the matching branch), and on Ubuntu apply the kernel update from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) followed by a reboot or livepatch. Cross-reference your branch's exact fix commit at https://git.kernel.org/stable/c/ before backporting. If patching must be deferred, the primary compensating control is to restrict who can program the OVS datapath: prevent untrusted workloads from obtaining CAP_NET_ADMIN (disable or constrain unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0), which blocks the exploitation path but may break rootless containers and some sandboxing. Where openvswitch is not required, unloading/blacklisting the openvswitch kernel module removes the attack surface entirely at the cost of losing OVS datapath functionality; on SDN/cloud hosts that need OVS, limit datapath control to trusted management planes only.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31679 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy