CVE-2026-31415: Linux Kernel IPv6 DoS Vulnerability

CVE-2026-31415 Overview

A locally exploitable integer overflow vulnerability exists in the Linux kernel's IPv6 network stack within the ip6_datagram_send_ctl() function. The vulnerability stems from a mismatch between the 16-bit length accumulator (struct ipv6_txoptions::opt_flen, type __u16) and the pointer to the last provided destination-options header (opt->dst1opt) when multiple IPV6_DSTOPTS control messages are provided.

An attacker with CAP_NET_RAW capability (or an unprivileged user with access to unprivileged user namespaces) can trigger a kernel panic via skb_under_panic(), resulting in a complete system denial of service.

Critical Impact

Local attackers can crash the Linux kernel by exploiting an integer overflow in IPv6 ancillary data handling, causing a system-wide denial of service through kernel BUG/panic.

Affected Products

• Linux kernel (IPv6 networking subsystem)
• Systems with unprivileged user namespaces enabled
• Systems where users have CAP_NET_RAW capability

Discovery Timeline

• April 13, 2026 - CVE-2026-31415 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31415

Vulnerability Analysis

The vulnerability resides in the IPv6 datagram socket control message processing path. The ip6_datagram_send_ctl() function in net/ipv6/datagram.c accepts repeated IPV6_DSTOPTS control messages and accumulates their lengths into a 16-bit field (opt_flen) without rejecting duplicates. This differs from the legacy IPV6_2292DSTOPTS path which properly rejects duplicate destination options.

The core issue is that when enough large IPV6_DSTOPTS control messages are provided, the 16-bit opt_flen accumulator wraps around while dst1opt still points to a large destination-options header. For example, an attacker can craft 32 control messages with hdrlen=255 (each contributing 2048 bytes) plus one additional message with hdrlen=0 (8 bytes), resulting in a total increment of 65,544 bytes. Due to the 16-bit overflow, opt_flen wraps to only 8, while dst1opt points to a 2048-byte header.

Root Cause

The root cause is the use of a 16-bit unsigned integer (__u16) for the opt_flen field in struct ipv6_txoptions combined with the lack of duplicate rejection or overflow checking in the IPV6_DSTOPTS control message handling path.

Key affected code locations:

• include/net/ipv6.h:298 - defines __u16 opt_flen; (wrap possible)
• net/ipv6/datagram.c:909-933 - accepts repeated IPV6_DSTOPTS and accumulates into opt_flen
• net/ipv6/ip6_output.c:1463-1465 - uses wrapped opt_flen for headroom calculations
• net/ipv6/exthdrs.c:1179-1184 - ipv6_push_exthdr() pushes the actual header size from dst1opt

Attack Vector

The attack exploits the mismatch between the wrapped opt_flen value used for buffer allocation decisions and the actual header size pointed to by dst1opt. When building the final socket buffer, the transmit path sizes headers using the wrapped opt_flen, causing insufficient headroom allocation. However, when pushing the actual extension header, the size comes from ipv6_optlen(opt->dst1opt) which reflects the true header size.

This results in skb_push() attempting to push more data than available headroom, triggering skb_under_panic() in net/core/skbuff.c which calls BUG() and crashes the kernel.

The attack requires CAP_NET_RAW in the target network namespace. An unprivileged user can obtain this capability by creating a user namespace combined with a network namespace when unprivileged user namespaces are enabled.

Detection Methods for CVE-2026-31415

Indicators of Compromise

• Kernel panic messages containing skb_under_panic in system logs
• Unexpected system crashes or reboots without hardware-related causes
• Multiple IPv6 sendmsg system calls with unusually large ancillary data preceding a crash
• Processes creating user namespaces followed by network namespace operations and IPv6 socket activity

Detection Strategies

• Monitor for kernel crash dumps and dmesg output containing skb_under_panic() or skb_panic references
• Implement system call auditing to detect repeated sendmsg() calls with large IPV6_DSTOPTS control messages
• Deploy kernel live patching detection to identify unpatched systems
• Use endpoint detection to monitor for processes creating user namespaces in conjunction with suspicious network operations

Monitoring Recommendations

• Enable kernel panic logging and ensure crash dumps are captured for forensic analysis
• Monitor system stability metrics and correlate unexpected reboots with user activity
• Implement network namespace creation auditing on sensitive systems
• Deploy runtime kernel protection solutions to detect exploitation attempts

How to Mitigate CVE-2026-31415

Immediate Actions Required

• Apply the kernel patches from the official Linux kernel git repository immediately
• Restrict access to CAP_NET_RAW capability where not strictly required
• Disable unprivileged user namespaces if not required by setting kernel.unprivileged_userns_clone=0
• Implement process isolation to limit the impact of local denial of service attacks

Patch Information

Multiple patches have been released to address this vulnerability across different kernel branches. The fix adds proper overflow checking and duplicate rejection for IPV6_DSTOPTS control messages:

• Linux Kernel Commit 0bdaf54d3aaddfe8df29371260fa8d4939b4fd6f
• Linux Kernel Commit 4e453375561fc60820e6b9d8ebeb6b3ee177d42e
• Linux Kernel Commit 5e4ee5dbea134e9257f205e31a96040bed71e83f
• Linux Kernel Commit 63fda74885555e6bd1623b5d811feec998740ba4
• Linux Kernel Commit 872b74900d5daa37067ac676d9001bb929fc6a2a
• Linux Kernel Commit 9ed81d692758dfb9471d7799b24bfa7a08224c31

Workarounds

• Disable unprivileged user namespaces system-wide to prevent unprivileged users from obtaining namespaced CAP_NET_RAW
• Use capability bounding sets to remove CAP_NET_RAW from processes that do not require raw socket access
• Implement container isolation policies that prevent network namespace creation
• Deploy mandatory access control (SELinux/AppArmor) policies to restrict IPv6 socket operations

# Disable unprivileged user namespaces (prevents unprivileged exploitation)
echo 0 > /proc/sys/kernel/unprivileged_userns_clone

# Or make it persistent via sysctl configuration
echo "kernel.unprivileged_userns_clone = 0" >> /etc/sysctl.d/99-security.conf
sysctl -p /etc/sysctl.d/99-security.conf

# Remove CAP_NET_RAW from capability bounding set for specific processes
# (implementation varies by init system and container runtime)