CVE-2026-31674: Linux Kernel Netfilter DoS Vulnerability

CVE-2026-31674 Overview

A vulnerability has been identified in the Linux kernel's netfilter subsystem, specifically in the ip6t_rt module responsible for matching IPv6 routing header extensions. The flaw exists in the rt_mt6_check() function which fails to properly validate the addrnr parameter against the IP6T_RT_HOPS boundary limit. This allows a local attacker with limited privileges to install malformed routing match rules that can trigger out-of-bounds memory access when the rt_mt6() function processes the rule, potentially leading to information disclosure or denial of service.

Critical Impact

Local attackers can exploit this vulnerability to read sensitive kernel memory or cause system crashes through crafted netfilter rules with oversized address number values.

Affected Products

• Linux Kernel (multiple stable versions)
• Systems using ip6tables with IPv6 routing header matching
• Network appliances and servers running affected kernel versions

Discovery Timeline

• 2026-04-25 - CVE CVE-2026-31674 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31674

Vulnerability Analysis

The vulnerability resides in the IPv6 routing header match extension (ip6t_rt) within the Linux kernel's netfilter framework. When a user configures ip6tables rules to match IPv6 routing headers, the kernel module stores configuration data in a structure that includes an addrnr field specifying the number of addresses to match.

The core issue is that the rt_mt6_check() function, which validates match rules during installation, does not verify that addrnr falls within the bounds defined by IP6T_RT_HOPS. The rtinfo->addrs[] array has a fixed size, but without proper validation, an attacker can specify an addrnr value exceeding this array's bounds.

When the match function rt_mt6() subsequently processes network packets against these malformed rules, it iterates based on the unchecked addrnr value, causing out-of-bounds array access. This can result in reading kernel memory beyond the allocated buffer (information disclosure) or triggering memory access violations that crash the system (denial of service).

Root Cause

The root cause is missing input validation in the rt_mt6_check() function. The function fails to enforce that user-supplied addrnr values remain within the IP6T_RT_HOPS constant boundary, which defines the maximum size of the addrs[] array in the routing match info structure. This is a classic boundary condition error where user-controlled input is trusted without verification before being used to index into fixed-size arrays.

Attack Vector

Exploitation requires local access with the ability to configure netfilter/ip6tables rules, typically requiring CAP_NET_ADMIN capability or root privileges. An attacker would craft an ip6tables rule with a routing header match (-m rt) specifying an addrnr value larger than IP6T_RT_HOPS. When this rule is installed, the kernel accepts it without validation. Subsequently, when IPv6 packets are processed against this rule, the kernel reads beyond the bounds of the addresses array.

The attack is performed locally and does not require user interaction. While it requires elevated privileges to configure netfilter rules, in containerized environments or systems with delegated network administration, this boundary may be crossed by semi-trusted users.

Detection Methods for CVE-2026-31674

Indicators of Compromise

• Unexpected kernel crashes or panics with stack traces referencing rt_mt6 or ip6t_rt modules
• System logs showing memory access violations in netfilter-related kernel code
• Unusual ip6tables rules with routing header match parameters containing abnormally high address count values
• Kernel oops messages indicating out-of-bounds access in the netfilter subsystem

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for BUG, WARNING, or OOPS messages referencing the ip6t_rt module
• Audit ip6tables configurations for routing header match rules (-m rt) with suspicious --rt-segsleft or address parameters
• Deploy kernel integrity monitoring to detect abnormal netfilter module behavior
• Implement audit rules to log all ip6tables configuration changes with user attribution

Monitoring Recommendations

• Enable kernel auditing for network administration capability usage (CAP_NET_ADMIN)
• Configure centralized logging for all systems to capture kernel-level events
• Implement automated alerting for kernel panic or crash events
• Use SentinelOne's Linux agent to monitor for suspicious netfilter configuration activities

How to Mitigate CVE-2026-31674

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the addrnr bounds checking fix
• Restrict access to ip6tables configuration to only trusted administrators
• Review existing ip6tables rules for any malformed routing header matches
• Consider temporarily disabling IPv6 routing header matching if not required for operations

Patch Information

The Linux kernel maintainers have released patches across multiple stable kernel branches to address this vulnerability. The fix adds proper validation in rt_mt6_check() to reject match rules where addrnr exceeds IP6T_RT_HOPS.

Patches are available through the following kernel commits:

• Kernel Commit 13e3e30
• Kernel Commit 29ea965
• Kernel Commit 9d3f027
• Kernel Commit a28ebf6
• Kernel Commit af9b7e2
• Kernel Commit c6a503a
• Kernel Commit d8795fd
• Kernel Commit ded71f5

Organizations should apply the appropriate patch for their kernel version through their Linux distribution's package manager.

Workarounds

• Unload the ip6t_rt kernel module if IPv6 routing header matching is not required: modprobe -r ip6t_rt
• Add the module to a blacklist to prevent automatic loading: add blacklist ip6t_rt to /etc/modprobe.d/blacklist.conf
• Restrict access to network namespace and netfilter configuration capabilities in container environments
• Implement strict access controls limiting which users can modify iptables/ip6tables rules

# Unload the vulnerable module if not in use
sudo modprobe -r ip6t_rt

# Blacklist the module to prevent automatic loading
echo "blacklist ip6t_rt" | sudo tee /etc/modprobe.d/blacklist-ip6t_rt.conf

# Verify the module is not loaded
lsmod | grep ip6t_rt