Skip to main content

Linux Kernel CVE-2026-31680

| EUVDEUVD-2026-25647 HIGH
2026-04-25 Linux
Denial Of Service Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local unprivileged trigger (AV:L/PR:L), timing-dependent race raises complexity (AC:H); freed-memory read may leak minor data (C:L) but realistic impact is a kernel crash (A:H), with no integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:13 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25647
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

ip6fl_seq_show() walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl->opt->opt_nflen when an option block is present.

Exclusive flowlabels currently free fl->opt as soon as fl->users drops to zero in fl_release(). However, the surrounding struct ip6_flowlabel remains visible in the global hash table until later garbage collection removes it and fl_free_rcu() finally tears it down.

A concurrent /proc/net/ip6_flowlabel reader can therefore race that early kfree() and dereference freed option state, triggering a crash in ip6fl_seq_show().

Fix this by keeping fl->opt alive until fl_free_rcu(). That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.

AnalysisAI

Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.

Technical ContextAI

The affected component is the IPv6 flow-label management code in net/ipv6/ip6_flowlabel.c. Flow labels are 20-bit fields in the IPv6 header that applications register via IPV6_FLOWLABEL_MGR socket options; 'exclusive' labels are owned by a single socket and carry an optional option block (fl->opt) holding extension-header data such as opt_nflen. Lifetime is managed with reference counting (fl->users) plus RCU: the label object itself is torn down in fl_free_rcu() after a grace period, but the exclusive path frees fl->opt eagerly in fl_release() the moment users hits zero. Meanwhile /proc/net/ip6_flowlabel is rendered by ip6fl_seq_show() walking the global hash under only the seq-file RCU read lock, which can still reach a label whose opt was already freed. This is a classic CWE-416 use-after-free arising from mismatched lifetimes between an inner object (fl->opt) and its RCU-protected container; the NVD CWE field is unpopulated (N/A). The fix defers freeing fl->opt to fl_free_rcu() so its lifetime matches the label readers can still observe.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, or 6.19.12, whichever matches your branch - or apply your distribution's update (Ubuntu USN-8567-1: https://ubuntu.com/security/notices/USN-8567-1). The upstream commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827 and the sibling backports). If immediate patching is not possible, reduce exposure by restricting read access to /proc/net/ip6_flowlabel (for example via hidepid mount options or tighter procfs permissions) since the crash requires a concurrent reader of that file, and where feasible limit untrusted local accounts on affected hosts; note these are only partial mitigations because the race can still be reached by any process that can both create exclusive flowlabels and read the proc entry, and hidepid can break monitoring tools that parse /proc. Managed/appliance users should track Siemens SSA-019113 and SSA-082556 for embedded fixes.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31680 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy