CVE-2026-31682

Received Received - Intake

Buffer Overflow in Linux Bridge br_nd_send Causes Memory Corruption

Publication date: 2026-04-25

Last updated on: 2026-05-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-25

Last Modified

2026-05-06

Generated

2026-07-06

AI Q&A

2026-04-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31682

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 5.11 (inc) to 5.15.203 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.168 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.81 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.134 (exc)
linux	linux_kernel	From 4.15 (inc) to 5.10.253 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

The vulnerability has been resolved by ensuring that the Linux kernel linearizes the skb before parsing neighbour discovery options in the br_nd_send() function.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Impact Analysis

This vulnerability can lead to improper handling of network packets in the Linux kernel's bridge code. Accessing data beyond the linear buffer could cause memory corruption, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service on affected systems.

Executive Summary

This vulnerability exists in the Linux kernel's bridge networking code, specifically in the function br_nd_send(). This function parses neighbor discovery (ND) options from a network packet. The issue arises because br_nd_send() assumes that the ND options are stored in a linear part of the packet buffer, but in reality, the options may be non-linear. This can cause the function to access data beyond the intended linear buffer area, potentially leading to incorrect behavior or memory access errors.

The fix involves linearizing the packet buffer before parsing the ND options to ensure safe and correct access to the data.

Hi! I’m here to help you understand CVE-2026-31682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70