CVE-2026-31682
Buffer Overflow in Linux Bridge br_nd_send Causes Memory Corruption
Publication date: 2026-04-25
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's bridge networking code, specifically in the function br_nd_send(). This function parses neighbor discovery (ND) options from a network packet. The issue arises because br_nd_send() assumes that the ND options are stored in a linear part of the packet buffer, but in reality, the options may be non-linear. This can cause the function to access data beyond the intended linear buffer area, potentially leading to incorrect behavior or memory access errors.
The fix involves linearizing the packet buffer before parsing the ND options to ensure safe and correct access to the data.
How can this vulnerability impact me? :
This vulnerability can lead to improper handling of network packets in the Linux kernel's bridge code. Accessing data beyond the linear buffer could cause memory corruption, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service on affected systems.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by ensuring that the Linux kernel linearizes the skb before parsing neighbour discovery options in the br_nd_send() function.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.