Skip to main content

Linux Kernel CVE-2026-31682

| EUVDEUVD-2026-25649 CRITICAL
Out-of-bounds Read (CWE-125)
2026-04-25 Linux
Buffer Overflow Information Disclosure Linux
Critical
Disputed · 9.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach L2 segment served by ND-proxy bridge
  2. Delivery
    Craft NS with options in non-linear skb
  3. Exploit
    br_nd_send parses ns->opt[] out of bounds
  4. Execution
    Read past linear buffer
  5. Impact
    Leak kernel memory or crash host

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target Linux host to be acting as a bridge with neighbour-discovery proxying / ND suppression enabled (br_nd_send is only reached on that proxy path) and to receive an IPv6 Neighbor Solicitation whose ND option area resides in the non-linear part of the skb - in practice a fragmented or specially crafted ICMPv6 packet, since normal small NS messages keep options in the linear region. Per the supplied CVSS (PR:N/UI:N) no authentication or user interaction is needed and the vector is network-reachable, but the practical limiting factors are significant: the bridge ND-proxy feature is not enabled by default on most deployments, the attacker must reach the bridge with IPv6 ND traffic on the relevant segment, and the option data must be non-linear to trigger the out-of-bounds read.
Impact

Signals conflict on severity. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H = 9.1 Critical) treats this as a trivially reachable network info-leak plus crash, but the feed tag is 'Information Disclosure' and the mechanism is an out-of-bounds READ, so the realistic primary impact is kernel memory disclosure and/or a DoS crash - not code execution. EPSS is negligible (0.03%, 8th percentile), the CVE is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. Two practical caveats temper the 'network, low-complexity' framing: exploitation requires the target to be running a bridge that performs ND proxying (neigh_suppress / proxy ND), which is a non-default configuration on many systems, and the bug only triggers when ND options land in the non-linear skb region, which generally means fragmented or otherwise crafted packets - arguably pushing real attack complexity higher than AC:L. Net assessment: a legitimately real memory-safety defect worth patching in the normal cycle, but the low EPSS, absence of KEV/POC, and configuration dependency make it a routine-priority kernel fix rather than an emergency.
Exploit ScenarioDerived

An attacker on a network segment served by a Linux bridge that proxies IPv6 neighbour discovery crafts a Neighbor Solicitation whose ND options are placed in the non-linear portion of the skb (e.g. via fragmentation), causing br_nd_send() to read beyond the linear buffer when parsing ns->opt[]. Depending on memory layout this leaks adjacent kernel data reflected/processed in the ND response or panics the host, yielding information disclosure or denial of service. No public exploit is identified at time of analysis.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).

RemediationAI

Vendor-released patch: update the kernel to a fixed stable release for your branch - 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or mainline 7.0 - via the upstream stable commits (e.g. https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662 and the sibling commits) or your distribution's package. Distro users should apply the vendor build directly: Ubuntu via USN-8490-1 (https://ubuntu.com/security/notices/USN-8490-1), and Siemens appliance operators per SSA-019113/SSA-082556. If immediate patching is not possible, the exposure is limited to bridges performing ND proxying, so a targeted compensating control is to disable neighbour-discovery suppression/proxy on affected bridges (e.g. clear the per-port neigh_suppress / proxy ND settings) where it is not required - the trade-off is loss of proxy-ND/ARP-suppression behavior in EVPN/overlay or virtualization setups that rely on it. Where the feature is needed, restrict which segments can reach the bridge with untrusted IPv6 traffic and filter/normalize fragmented ICMPv6 ND packets at the network edge to reduce the chance of non-linear option data reaching the parser.

Affected VersionsENISA

Linux patch: 6.12.81
Linux ed842faeb2bd49256f00485402f3113205f91d30 <9c55e41c73af5c4511070933b1bd25248521270c
Linux patch: 6.18.22
Linux ed842faeb2bd49256f00485402f3113205f91d30 <4f397b950c916e9a1f8a4fce04ea0110206cad47
Linux ed842faeb2bd49256f00485402f3113205f91d30 <3a30f6469b058574f49efde61cd6f5d79e576053
Linux ed842faeb2bd49256f00485402f3113205f91d30 <c68433fd291c9e88c00292095172c62d1997d662
Linux patch: 0
Linux patch: 5.10.253
Linux ed842faeb2bd49256f00485402f3113205f91d30 <bd91ec85aa4c77d645bd2739fc56784157a88ca2
Linux patch: 6.19.12
Linux ed842faeb2bd49256f00485402f3113205f91d30 <2ba4caba423ed94d63006eb1d2227b0332ab7fcd
Linux patch: 5.15.203
Linux patch: 6.1.168
Linux patch: 6.6.134
Linux patch: 7.0
Linux ed842faeb2bd49256f00485402f3113205f91d30 <a01aee7cafc575bb82f5529e8734e7052f9b16ea
Linux ed842faeb2bd49256f00485402f3113205f91d30 <658261898130da620fc3d0fbb0523efb3366cb55
Linux 4.15

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Linux kernel bridge module's IPv6 neighbour-discovery proxy path (net/bridge), specifically br_nd_send(), which builds/parses ND messages when the bridge answers Neighbor Solicitations on behalf of hosts. In the kernel, packet data is held in an sk_buff (skb) that may be partly 'linear' (contiguous head buffer) and partly non-linear (paged fragments); only data covered by pskb_may_pull()/header guarantees is safe to dereference directly. Here the code indexes ns->opt[] (the ND options array) directly off the linear network header while callers had only ensured the ICMPv6 header and target address were pulled into the linear area, so options carried in fragments are read out of bounds. The root cause is a classic CWE-125 (Out-of-bounds Read) - the CWE field is 'N/A' in the feed, but the description ('access data past the linear buffer') is unambiguously an OOB read, remediated by linearizing the skb (skb_linearize) and re-deriving ns from the linear network header before option parsing.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 7.4 HIGH

Network-reachable and unauthenticated, but requires a non-default ND-proxy bridge and non-linear (fragmented) options to trigger, so AC:H; OOB read gives C:H and crash A:H, no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE CRITICAL
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.1 (CRITICAL)
Patch available
Apr 25, 2026 - 10:16 EUVD
CVE Published
Apr 25, 2026 - 08:46 nvd
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bridge: br_nd_send: linearize skb before parsing ND options

br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request.

Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer.

Linearize request before option parsing and derive ns from the linear network header.

Executive ViewAI

Why It Matters

CVE-2026-31682 is a critical Linux kernel vulnerability in bridge neighbor discovery that enables remote memory disclosure and denial-of-service attacks against systems with IPv6 bridging enabled. Organizations operating Linux infrastructure must prioritize patching to prevent kernel memory leaks that could expose sensitive data and loss of service availability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel underlies a huge fraction of servers and appliances
Threat Intel
2
1 source
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

56
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8490-1 ADVISORY https://vuldb.com/vuln/359580 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd REF https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053 REF https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47 REF https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55 REF https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c REF https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea REF https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2 REF https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy