CVE-2026-31415: Linux Kernel IPv6 DoS Vulnerability

CVE-2026-31415 Overview

A locally exploitable integer overflow vulnerability exists in the Linux kernel's IPv6 network stack within the ip6_datagram_send_ctl() function. The vulnerability stems from a mismatch between the 16-bit length accumulator (struct ipv6_txoptions::opt_flen, type __u16) and the pointer to the last provided destination-options header (opt->dst1opt) when multiple IPV6_DSTOPTS control messages are provided.

An attacker with CAP_NET_RAW capability (or an unprivileged user with access to unprivileged user namespaces) can trigger a kernel panic via skb_under_panic(), resulting in a complete system denial of service.

Critical Impact
Local attackers can crash the Linux kernel by exploiting an integer overflow in IPv6 ancillary data handling, causing a system-wide denial of service through kernel BUG/panic.

Affected Products

Linux kernel (IPv6 networking subsystem)
Systems with unprivileged user namespaces enabled
Systems where users have CAP_NET_RAW capability

Discovery Timeline

April 13, 2026 - CVE-2026-31415 published to NVD
April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31415

Vulnerability Analysis

The vulnerability resides in the IPv6 datagram socket control message processing path. The ip6_datagram_send_ctl() function in net/ipv6/datagram.c accepts repeated IPV6_DSTOPTS control messages and accumulates their lengths into a 16-bit field (opt_flen) without rejecting duplicates. This differs from the legacy IPV6_2292DSTOPTS path which properly rejects duplicate destination options.

The core issue is that when enough large IPV6_DSTOPTS control messages are provided, the 16-bit opt_flen accumulator wraps around while dst1opt still points to a large destination-options header. For example, an attacker can craft 32 control messages with hdrlen=255 (each contributing 2048 bytes) plus one additional message with hdrlen=0 (8 bytes), resulting in a total increment of 65,544 bytes. Due to the 16-bit overflow, opt_flen wraps to only 8, while dst1opt points to a 2048-byte header.

Root Cause

The root cause is the use of a 16-bit unsigned integer (__u16) for the opt_flen field in struct ipv6_txoptions combined with the lack of duplicate rejection or overflow checking in the IPV6_DSTOPTS control message handling path.

Key affected code locations:

include/net/ipv6.h:298 - defines __u16 opt_flen; (wrap possible)
net/ipv6/datagram.c:909-933 - accepts repeated IPV6_DSTOPTS and accumulates into opt_flen
net/ipv6/ip6_output.c:1463-1465 - uses wrapped opt_flen for headroom calculations
net/ipv6/exthdrs.c:1179-1184 - ipv6_push_exthdr() pushes the actual header size from dst1opt

Attack Vector

The attack exploits the mismatch between the wrapped opt_flen value used for buffer allocation decisions and the actual header size pointed to by dst1opt. When building the final socket buffer, the transmit path sizes headers using the wrapped opt_flen, causing insufficient headroom allocation. However, when pushing the actual extension header, the size comes from ipv6_optlen(opt->dst1opt) which reflects the true header size.

This results in skb_push() attempting to push more data than available headroom, triggering skb_under_panic() in net/core/skbuff.c which calls BUG() and crashes the kernel.

The attack requires CAP_NET_RAW in the target network namespace. An unprivileged user can obtain this capability by creating a user namespace combined with a network namespace when unprivileged user namespaces are enabled.

Detection Methods for CVE-2026-31415

Indicators of Compromise

Kernel panic messages containing skb_under_panic in system logs
Unexpected system crashes or reboots without hardware-related causes
Multiple IPv6 sendmsg system calls with unusually large ancillary data preceding a crash
Processes creating user namespaces followed by network namespace operations and IPv6 socket activity

Detection Strategies

Monitor for kernel crash dumps and dmesg output containing skb_under_panic() or skb_panic references
Implement system call auditing to detect repeated sendmsg() calls with large IPV6_DSTOPTS control messages
Deploy kernel live patching detection to identify unpatched systems
Use endpoint detection to monitor for processes creating user namespaces in conjunction with suspicious network operations

Monitoring Recommendations

Enable kernel panic logging and ensure crash dumps are captured for forensic analysis
Monitor system stability metrics and correlate unexpected reboots with user activity
Implement network namespace creation auditing on sensitive systems
Deploy runtime kernel protection solutions to detect exploitation attempts

How to Mitigate CVE-2026-31415

Immediate Actions Required

Apply the kernel patches from the official Linux kernel git repository immediately
Restrict access to CAP_NET_RAW capability where not strictly required
Disable unprivileged user namespaces if not required by setting kernel.unprivileged_userns_clone=0
Implement process isolation to limit the impact of local denial of service attacks

Patch Information

Multiple patches have been released to address this vulnerability across different kernel branches. The fix adds proper overflow checking and duplicate rejection for IPV6_DSTOPTS control messages:

Workarounds

Disable unprivileged user namespaces system-wide to prevent unprivileged users from obtaining namespaced CAP_NET_RAW
Use capability bounding sets to remove CAP_NET_RAW from processes that do not require raw socket access
Implement container isolation policies that prevent network namespace creation
Deploy mandatory access control (SELinux/AppArmor) policies to restrict IPv6 socket operations

bash

# Disable unprivileged user namespaces (prevents unprivileged exploitation)
echo 0 > /proc/sys/kernel/unprivileged_userns_clone

# Or make it persistent via sysctl configuration
echo "kernel.unprivileged_userns_clone = 0" >> /etc/sysctl.d/99-security.conf
sysctl -p /etc/sysctl.d/99-security.conf

# Remove CAP_NET_RAW from capability bounding set for specific processes
# (implementation varies by init system and container runtime)