Skip to main content

Linux Kernel CVE-2026-31685

| EUVDEUVD-2026-25652 CRITICAL
2026-04-25 Linux
Information Disclosure Linux
Critical
Disputed · 9.4 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.4 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
4.2 MEDIUM

L2-scoped Ethernet match gives AV:A; requires non-default eui64 rule plus malformed MAC header (AC:H); bounded OOB read yields C:L and possible crash A:L, no integrity impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
7.1 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:10 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
9.4 (CRITICAL)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25652
CVE Published
Apr 25, 2026 - 08:47 nvd
CRITICAL 9.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_eui64: reject invalid MAC header for all packets

eui64_mt6() derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address.

The existing guard only rejects an invalid MAC header when par->fragoff != 0. For packets with par->fragoff == 0, eui64_mt6() can still reach eth_hdr(skb) even when the MAC header is not valid.

Fix this by removing the par->fragoff != 0 condition so that packets with an invalid MAC header are rejected before accessing eth_hdr(skb).

AnalysisAI

Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).

Technical ContextAI

The affected code is the xt_eui64 / ip6t_eui64 netfilter match (net/netfilter/xt_eui64.c) used within ip6tables rules. eui64_mt6() constructs a modified EUI-64 identifier from the Ethernet source MAC address (via eth_hdr(skb)) and compares it against the low 64 bits of the IPv6 source address to detect stateless autoconfiguration addresses. The root cause is an unchecked-condition access: the skb_mac_header_was_set()/MAC-header validity check was gated behind the par->fragoff != 0 branch, so packets with fragoff == 0 bypassed validation and could dereference an Ethernet header that was never present or is out of bounds. This is functionally a CWE-125 style out-of-bounds read / missing input validation; the input CWE field is N/A but the behavior maps to reading memory beyond a validated header. CPE data identifies the product only generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, with the introducing commit dating back to the 2.6.12 era (1da177e4).

RemediationAI

Upgrade to a patched stable kernel: Patch available per vendor advisory, with fixed versions indicated around 6.12.83, 6.18.24, and 6.19.14 (confirm the exact fixed build for your branch against the git.kernel.org stable commits such as 9eda5478746e and 807d6ee15804, and apply your distribution's update - Ubuntu users should install the kernel from USN-8490-1). As a targeted compensating control until patched, remove or avoid ip6tables rules that use the eui64 match (iptables-legacy/nft ip6 eui64), since the vulnerable code path is only reachable when such a rule is active; the trade-off is loss of that specific stateless-autoconf address filtering capability, which is rarely used. Because exploitation is Layer-2 scoped, restricting untrusted hosts from the affected L2 segments and enforcing switch-level protections further limits exposure. Do not rely on network ACLs alone if the eui64 rule is present, as the trigger is a malformed local Ethernet frame.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31685 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy