Linux Kernel EUVD-2026-26565

The vulnerability exists in the Linux kernel's bridge module, specifically in the br_nd_send() function which processes IPv6 Neighbor Discovery (ND) options. ND is part of ICMPv6 and uses a variable-length option format where each option header includes a length field indicating the option's size. The br_nd_send() function walks through these options by advancing a pointer according to the length values without validating that the specified lengths fit within the remaining ND option area. This allows a malformed option with an excessively large length value to cause the parser to read beyond allocated memory bounds. Additionally, the source Link-Layer Address (LLADDR) option is accessed without confirming the option payload is large enough to contain a complete Ethernet address (6 bytes), risking out-of-bounds reads. The fix adds validation of option lengths against remaining buffer space before parser advancement and ensures source LLADDR options have sufficient length before accessing the address payload.