CVE-2026-31685
Use-After-Free in Linux netfilter ip6t_eui64 Allows Invalid MAC Access
Publication date: 2026-04-25
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netfilter component, specifically in the ip6t_eui64 module. The function eui64_mt6() derives a modified EUI-64 identifier from the Ethernet source address and compares it with the lower 64 bits of the IPv6 source address.
The issue is that the existing check only rejects packets with an invalid MAC header if the packet's fragment offset (par->fragoff) is not zero. For packets where par->fragoff is zero, the function can still access the Ethernet header even if it is invalid, which can lead to improper handling of such packets.
The fix removes the condition that restricts the check to only fragmented packets, ensuring that all packets with invalid MAC headers are rejected before accessing the Ethernet header.
How can this vulnerability impact me? :
This vulnerability can lead to improper processing of network packets with invalid MAC headers in the Linux kernel. Specifically, it allows packets with invalid MAC headers and zero fragment offset to bypass validation checks.
Such improper handling could potentially be exploited to cause unexpected behavior in the kernel's network stack, which might lead to denial of service or other security issues depending on how the kernel processes these malformed packets.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by updating the Linux kernel to reject invalid MAC headers for all packets in the netfilter ip6t_eui64 module.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.