Skip to main content

Linux Kernel CVE-2026-31682

| EUVDEUVD-2026-25649 CRITICAL
2026-04-25 Linux
Information Disclosure Linux
Critical
Disputed · 9.1 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.4 HIGH

Network-reachable and unauthenticated, but requires a non-default ND-proxy bridge and non-linear (fragmented) options to trigger, so AC:H; OOB read gives C:H and crash A:H, no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:12 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.1 (CRITICAL)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25649
CVE Published
Apr 25, 2026 - 08:46 nvd
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bridge: br_nd_send: linearize skb before parsing ND options

br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request.

Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer.

Linearize request before option parsing and derive ns from the linear network header.

AnalysisAI

Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).

Technical ContextAI

The affected component is the Linux kernel bridge module's IPv6 neighbour-discovery proxy path (net/bridge), specifically br_nd_send(), which builds/parses ND messages when the bridge answers Neighbor Solicitations on behalf of hosts. In the kernel, packet data is held in an sk_buff (skb) that may be partly 'linear' (contiguous head buffer) and partly non-linear (paged fragments); only data covered by pskb_may_pull()/header guarantees is safe to dereference directly. Here the code indexes ns->opt[] (the ND options array) directly off the linear network header while callers had only ensured the ICMPv6 header and target address were pulled into the linear area, so options carried in fragments are read out of bounds. The root cause is a classic CWE-125 (Out-of-bounds Read) - the CWE field is 'N/A' in the feed, but the description ('access data past the linear buffer') is unambiguously an OOB read, remediated by linearizing the skb (skb_linearize) and re-deriving ns from the linear network header before option parsing.

RemediationAI

Vendor-released patch: update the kernel to a fixed stable release for your branch - 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or mainline 7.0 - via the upstream stable commits (e.g. https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662 and the sibling commits) or your distribution's package. Distro users should apply the vendor build directly: Ubuntu via USN-8490-1 (https://ubuntu.com/security/notices/USN-8490-1), and Siemens appliance operators per SSA-019113/SSA-082556. If immediate patching is not possible, the exposure is limited to bridges performing ND proxying, so a targeted compensating control is to disable neighbour-discovery suppression/proxy on affected bridges (e.g. clear the per-port neigh_suppress / proxy ND settings) where it is not required - the trade-off is loss of proxy-ND/ARP-suppression behavior in EVPN/overlay or virtualization setups that rely on it. Where the feature is needed, restrict which segments can reach the bridge with untrusted IPv6 traffic and filter/normalize fragmented ICMPv6 ND packets at the network edge to reduce the chance of non-linear option data reaching the parser.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31682 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy