CVE-2026-31415
Integer Overflow in Linux Kernel IPv6 Destination Options Causes Local DoS
Publication date: 2026-04-13
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's IPv6 implementation, specifically in the function ip6_datagram_send_ctl(). It involves a mismatch between a 16-bit length accumulator (opt_flen) and a pointer to the last provided destination-options header (dst1opt) when multiple IPV6_DSTOPTS control messages are provided.
The opt_flen variable is a 16-bit unsigned integer that accumulates the length of destination options headers. When multiple IPV6_DSTOPTS control messages are sent, opt_flen is incremented each time without rejecting duplicates, which can cause it to wrap around due to its limited size.
However, the pointer dst1opt still points to the last large destination-options header, which can be much larger than the wrapped opt_flen value suggests. This causes the kernel to underestimate the required buffer size (headroom) when processing these headers.
When the kernel tries to push these headers onto the socket buffer (skb), it uses the wrapped opt_flen for size calculations, leading to insufficient headroom. This triggers an underflow in skb_push(), which calls skb_under_panic(), resulting in a kernel BUG and panic (system crash).
This vulnerability can be triggered locally by a user with CAP_NET_RAW capability or by an unprivileged user if unprivileged user namespaces are enabled and they can create a user namespace with CAP_NET_RAW.
How can this vulnerability impact me? :
This vulnerability can cause a local denial of service (DoS) by crashing the Linux kernel through a BUG/panic triggered by skb_under_panic().
An attacker with the appropriate privileges (CAP_NET_RAW) or an unprivileged user in certain configurations can exploit this to crash the system, causing it to become unavailable until rebooted.
This can disrupt services running on the affected system, potentially leading to downtime and loss of availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided CVE description does not include any information about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be triggered only by processes with CAP_NET_RAW capability in the target network namespace.
Immediate mitigation steps include restricting or removing CAP_NET_RAW capability from untrusted users or processes.
Additionally, disabling unprivileged user namespaces can prevent unprivileged users from gaining CAP_NET_RAW in a user namespace and exploiting this vulnerability.
Applying the vendor's patch or updating the Linux kernel to a fixed version once available is the definitive mitigation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a local kernel bug triggered by sending multiple IPV6_DSTOPTS control messages (cmsgs) with large destination-options headers that cause an overflow and kernel panic. Detection involves identifying attempts to send such crafted IPv6 packets with repeated IPV6_DSTOPTS ancillary data.
Since the vulnerability requires CAP_NET_RAW capability and is triggered locally, detection can focus on monitoring for processes using raw sockets or sending IPv6 packets with multiple destination options headers.
Suggested commands to help detect potential exploitation attempts include:
- Use auditd or similar to monitor usage of raw sockets: audit rules can watch for syscalls like socket(AF_INET6, SOCK_RAW, IPPROTO_RAW).
- Check for processes with CAP_NET_RAW capability: `capsh --print` or `getpcaps <pid>`.
- Use packet capture tools (tcpdump, wireshark) to filter for IPv6 packets with destination options headers: `tcpdump -i <interface> 'ip6[6] == 60'` (where 60 is the Next Header value for Destination Options).
- Look for kernel logs indicating skb_under_panic or BUG() calls related to skb_push failures, e.g., `dmesg | grep skb_under_panic` or `dmesg | grep BUG`.
No specific detection scripts or commands are provided in the available information.