CVE-2026-31674: Linux Kernel Netfilter DoS Vulnerability

CVE-2026-31674 Overview

CVE-2026-31674 is a Linux kernel vulnerability in the netfilter subsystem, specifically within the IPv6 routing header match module ip6t_rt. The function rt_mt6_check() failed to validate the addrnr field against the IP6T_RT_HOPS bound when installing match rules. A malformed rule could cause rt_mt6() to access memory beyond the rtinfo->addrs[] array during match logic. The patch rejects oversized addrnr values during rule installation so out-of-range values never reach the match path.

Critical Impact
A local attacker with CAP_NET_ADMIN capability can supply a malformed ip6t_rt rule that triggers an out-of-bounds access in kernel space, leading to kernel memory disclosure or a denial of service.

Affected Products

Linux Kernel (multiple stable branches, originating from commits as early as 2.6.12)
Distributions shipping the unpatched ip6t_rt netfilter module
IPv6-enabled systems running ip6tables with the rt match

Discovery Timeline

2026-04-25 - CVE-2026-31674 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31674

Vulnerability Analysis

The ip6t_rt module implements an ip6tables match for IPv6 Routing Header fields. Rules carry an addrnr field indicating how many IPv6 addresses appear in the rtinfo->addrs[] array. The kernel constant IP6T_RT_HOPS defines the maximum number of address entries the array can hold.

Before this fix, rt_mt6_check() accepted any addrnr value passed from user space. When a packet matched, rt_mt6() iterated over rtinfo->addrs[] using addrnr as the loop bound. Supplying an addrnr larger than IP6T_RT_HOPS caused the comparison loop to read past the end of the fixed-size address array.

The patch adds a bounds check in rt_mt6_check() so the rule installation path rejects malformed input. This shifts validation to rule load time, preventing the match function from operating on attacker-controlled, out-of-range counts. The issue is classified under [CWE-noinfo] pending detailed weakness assignment.

Root Cause

The root cause is missing input validation in the rt_mt6_check() entry point. The function trusted the user-supplied addrnr instead of comparing it to IP6T_RT_HOPS. Because rtinfo->addrs[] is a fixed-size array embedded in the rule structure, any iteration count above the maximum produces an out-of-bounds read.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability inside the current network namespace, which an unprivileged user can obtain inside a user namespace on many distributions. The attacker calls setsockopt() with IPT_SO_SET_REPLACE (or the ip6tables equivalent) to load a crafted rule containing an oversized addrnr. When subsequent IPv6 traffic with a Routing Header is processed, the match function reads kernel memory outside the intended array. Depending on adjacent memory, this produces information disclosure or a kernel crash leading to denial of service. No verified public proof-of-concept is currently available.

See the upstream fixes for technical details: Kernel Git Commit ded71f5 and Kernel Git Commit 13e3e30.

Detection Methods for CVE-2026-31674

Indicators of Compromise

Unexpected ip6tables rule additions referencing the rt (Routing Header) match from non-administrative processes or containers.
Kernel oops or panic messages referencing rt_mt6, rt_mt6_check, or the ip6t_rt module in dmesg or /var/log/kern.log.
Processes invoking setsockopt with IP6T_SO_SET_REPLACE from unprivileged user namespaces.

Detection Strategies

Audit execve events for ip6tables, nft, or iptables-restore invocations adding -m rt rules and compare them against approved firewall baselines.
Monitor kernel ring buffer output for KASAN, slab-out-of-bounds, or general protection fault reports tied to netfilter symbols.
Inspect loaded netfilter rules with ip6tables-save and flag rules whose addrnr parameter exceeds the kernel's IP6T_RT_HOPS limit.

Monitoring Recommendations

Enable Linux audit rules covering CAP_NET_ADMIN operations and capture syscall context for the setsockopt family.
Forward kernel logs and netfilter rule changes to a centralized analytics platform to correlate rule installs with subsequent kernel faults.
Track unprivileged user namespace creation (unshare, clone with CLONE_NEWUSER) on multi-tenant hosts where container workloads run.

How to Mitigate CVE-2026-31674

Immediate Actions Required

Apply the latest stable kernel update from your distribution vendor containing the rt_mt6_check() bounds validation.
Restrict CAP_NET_ADMIN inside containers and disable unprivileged user namespaces where not required by setting kernel.unprivileged_userns_clone=0.
Inventory hosts running IPv6 with ip6tablesrt match rules and prioritize patching those systems.

Patch Information

The fix is committed across multiple stable branches. Reference patches include Kernel Git Commit ded71f5, Kernel Git Commit 13e3e30, Kernel Git Commit 29ea965, Kernel Git Commit 9d3f027, Kernel Git Commit a28ebf6, Kernel Git Commit af9b7e2, Kernel Git Commit c6a503a, and Kernel Git Commit d8795fd. The change adds a bounds check rejecting any rule whose addrnr exceeds IP6T_RT_HOPS.

Workarounds

Blacklist the ip6t_rt module with install ip6t_rt /bin/true in /etc/modprobe.d/ on systems that do not require Routing Header matching.
Drop CAP_NET_ADMIN from container runtimes and service unit files where firewall management is not needed.
Disable unprivileged user namespaces on shared hosts to remove the privilege path that exposes the setsockopt interface to standard users.

bash

# Configuration example: disable unprivileged user namespaces and block the module
echo 'kernel.unprivileged_userns_clone = 0' | sudo tee /etc/sysctl.d/99-cve-2026-31674.conf
sudo sysctl --system

echo 'install ip6t_rt /bin/true' | sudo tee /etc/modprobe.d/disable-ip6t_rt.conf
sudo modprobe -r ip6t_rt 2>/dev/null || true