CVE-2026-31682

Critical · CVSS 9.1

Linux Kernel — Out-of-bounds memory access via non-linear SKB parsing in bridge neighbor discovery

CVSS: 9.1; nvd
EPSS: 0.42%; 34th pct
KEV: No
Class: oss containerizable; NVD-CWE-noinfo

Description

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

Search profile — drives PoC discovery

Symbols br_nd_sendns->optlinearize_skbICMPv6br_multicast_nd_sendskb_linearizendisc_optbr_ip6_multicast_alloc_query

Keywords CVE-2026-31682br_nd_sendlinearize skbND optionsLinux kernel bridgeneighbour discovery non-linearskb_linearize bridgeICMPv6 bridge ND parsingbr_nd_send out-of-bounds

Versions: Linux kernel versions prior to fixes at commits 2ba4caba423e, 3a30f6469b05, 4f397b950c91, 65826189813, 9c55e41c73af

Affected packages

Linux	Kernel	4.15.0 → 5.10.253
Linux	Kernel	5.11.0 → 5.15.203
Linux	Kernel	5.16.0 → 6.1.168
Linux	Kernel	6.13.0 → 6.18.22
Linux	Kernel	6.19.0 → 6.19.12
Linux	Kernel	6.2.0 → 6.6.134
Linux	Kernel	6.7.0 → 6.12.81

References

Status: enriched · ingested 2026-07-14T18:00:20.000Z · profiled 2026-07-14T18:30:20.000Z