Skip to main content

Linux Kernel EUVDEUVD-2026-19197

| CVE-2026-31407 HIGH
Out-of-bounds Write (CWE-787)
2026-04-06 Linux GHSA-cf8w-8g67-48gv
Buffer Overflow Linux Memory Corruption
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Reached only via local ctnetlink requiring CAP_NET_ADMIN (PR:L, AV:L); out-of-bounds read leaks kernel memory (C:H) and can panic the host (A:H), with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 08:14 vuln.today
CVSS changed
Apr 27, 2026 - 14:22 NVD
7.1 (HIGH)
Patch available
Apr 16, 2026 - 05:29 EUVD
0fbae1e74493d5a160a70c51aeba035d8266ea7d
EUVD ID Assigned
Apr 06, 2026 - 08:15 euvd
EUVD-2026-19197
CVE Published
Apr 06, 2026 - 07:38 cve.org
HIGH 7.1
CVE Published
Apr 06, 2026 - 07:38 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: add missing netlink policy validations

Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.

These attributes are used by the kernel without any validation. Extend the netlink policies accordingly.

Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..]

and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.

AnalysisAI

Local out-of-bounds memory access in the Linux kernel netfilter connection-tracking (conntrack) subsystem allows a low-privileged user holding CAP_NET_ADMIN to read kernel slab memory well beyond object bounds. The flaw stems from ctnetlink and SCTP conntrack code trusting user-supplied netlink attributes without range validation, so a crafted CTA_PROTOINFO_SCTP_STATE value or an expectation with exp->dir=100 causes reads far past a 320-byte nf_conn object (confirmed via UBSAN by the reporter). No public exploit has been identified and EPSS is negligible (0.01%), but the bug is a confirmed, patched memory-safety defect suitable for kernel information disclosure or denial of service.

Technical ContextAI

The affected component is netfilter's connection tracking layer, specifically the ctnetlink interface (nf_conntrack_netlink) and the SCTP protocol tracker (nf_conntrack_proto_sctp). ctnetlink lets userspace create and update conntrack and expectation entries over netlink. The reporter, Hyunwoo Kim, found that nlattr_to_sctp() copies the CTA_PROTOINFO_SCTP_STATE attribute directly into ct->proto.sctp.state with no bounds check, and that an expectation direction (exp->dir) is used as an index into ct->master->tuplehash[] without validation - a value of 100 indexes 5600 bytes past the 320-byte nf_conn allocation. Root cause maps to CWE-787 (out-of-bounds write per NVD classification), though the reporter demonstrates an out-of-bounds READ; the underlying defect class is missing input validation on netlink policy attributes. The fix extends the netlink nla_policy definitions so the kernel rejects out-of-range values before use.

RemediationAI

Vendor-released patch: upgrade to Linux stable 6.19.10 (or 7.0-rc5 / later mainline) or apply your distribution's patched kernel - Ubuntu users should install the fix from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot. The upstream fixes are the kernel.org stable commits listed on https://nvd.nist.gov/vuln/detail/CVE-2026-31407 (e.g. https://git.kernel.org/stable/c/0fbae1e74493d5a160a70c51aeba035d8266ea7d). If patching cannot be done immediately, reduce exposure by restricting who can reach the ctnetlink interface: because exploitation requires CAP_NET_ADMIN, disable or restrict unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 where supported, or user.max_user_namespaces=0) to prevent unprivileged users from acquiring CAP_NET_ADMIN in a private netns - the trade-off is that this breaks container runtimes and sandboxes that rely on unprivileged user namespaces. As defense-in-depth, minimize CAP_NET_ADMIN grants and audit containers that hold it. These controls do not fix the underlying bug and should be temporary until the patched kernel is deployed.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-19197 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy