CVE-2026-31682: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31682 Overview

CVE-2026-31682 is a Linux kernel vulnerability in the bridge subsystem's br_nd_send() function. The function parses Neighbour Discovery (ND) options from ns->opt[] and assumes those options reside in the linear portion of the socket buffer (skb). However, callers only guarantee that the ICMPv6 header and target address are linearized. When ND option data sits in non-linear (paged) skb fragments, parsing reads past the linear buffer boundary, producing an out-of-bounds read in kernel memory.

The issue affects Linux kernel versions including 7.0 release candidates rc1 through rc6. The Linux kernel maintainers have resolved the issue by linearizing the request before option parsing and deriving ns from the linear network header.

Critical Impact
A remote, unauthenticated attacker on an adjacent IPv6 network can craft Neighbour Solicitation messages that trigger out-of-bounds memory access in kernel space, leading to information disclosure or kernel crashes (denial of service) on systems acting as bridges.

Affected Products

Linux Kernel (multiple stable branches receiving backports)
Linux Kernel 7.0-rc1 through 7.0-rc6
Systems using the Linux bridge module with IPv6 Neighbour Discovery enabled

Discovery Timeline

2026-04-25 - CVE-2026-31682 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31682

Vulnerability Analysis

The vulnerability resides in br_nd_send() in the Linux bridge driver, which constructs and processes IPv6 Neighbour Discovery messages during bridged neighbour proxy operations. The function dereferences ns->opt[] to read ND option type-length-value (TLV) records that follow the Neighbour Solicitation header.

Network drivers and the IPv6 stack only guarantee that the ICMPv6 header and the target address are pulled into the skb's linear data region. Anything beyond that, including ND options, can remain in skb->frags[] paged fragments. When br_nd_send() walks ns->opt[] directly, it reads memory adjacent to the linear buffer, which may hold unrelated kernel data or unmapped memory.

The fix linearizes the skb with the appropriate kernel helper before option parsing and re-derives the ns pointer from the now-contiguous network header. This guarantees that all option bytes referenced through ns->opt[] are valid, in-bounds memory.

Root Cause

The root cause is an unchecked assumption about skb layout. br_nd_send() treats ns->opt[] as a contiguous in-buffer array, but the caller contract only linearizes through the ICMPv6 target address. Without an explicit skb_linearize() or pskb_may_pull() call covering the option region, the option parser reads past the end of the linear segment. This is classified under [NVD-CWE-noinfo] but maps to an Out-of-Bounds Read pattern.

Attack Vector

An attacker on the same IPv6 link as a Linux host configured as a bridge can send crafted Neighbour Solicitation packets whose option data spans skb fragments. The kernel ingests the packet, the bridge processes it through br_nd_send(), and the option parser dereferences memory past the linear buffer. No authentication, privileges, or user interaction are required. The result is either information leakage from adjacent kernel memory or a kernel oops causing denial of service on the bridging host.

The vulnerability manifests in the bridge neighbour discovery handling path. Refer to the upstream patches such as Linux Kernel Commit c68433fd and Linux Kernel Commit 9c55e41c for technical details.

Detection Methods for CVE-2026-31682

Indicators of Compromise

Kernel oops or panic messages referencing br_nd_send or the bridge module in dmesg or /var/log/kern.log.
KASAN reports flagging out-of-bounds reads in the bridge ND code path on instrumented kernels.
Unusual volumes of inbound IPv6 Neighbour Solicitation traffic targeting bridged interfaces.

Detection Strategies

Inventory hosts running the Linux bridge module with IPv6 enabled and compare installed kernel versions against the fixed stable branches listed in the kernel.org commits.
Enable kernel runtime hardening features such as KASAN and panic_on_oops in test environments to surface out-of-bounds reads before production exposure.
Monitor for repeated crashes of bridging hosts that correlate with bursts of ICMPv6 type 135 (Neighbour Solicitation) packets.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on stack traces containing br_nd_send or ndisc_parse_options.
Use IPv6-aware IDS rules to flag malformed or oversized Neighbour Solicitation options on bridged segments.
Track package and kernel update status across the fleet to confirm patch deployment.

How to Mitigate CVE-2026-31682

Immediate Actions Required

Apply the upstream kernel patches or update to a fixed stable kernel release from your distribution as soon as builds are available.
Restrict untrusted devices on layer-2 segments served by Linux bridges, since the attack requires adjacent network access.
Disable the bridge module on hosts that do not require layer-2 bridging using modprobe -r bridge and blacklisting the module.

Patch Information

The Linux kernel maintainers fixed the issue by linearizing the skb before parsing ND options. Patches are available across multiple stable branches in commits 2ba4caba, 3a30f646, 4f397b95, 65826189, 9c55e41c, a01aee7c, bd91ec85, and c68433fd.

Workarounds

If patching is not immediately feasible, disable IPv6 on bridged interfaces using sysctl -w net.ipv6.conf.<bridge>.disable_ipv6=1.
Filter inbound ICMPv6 type 135 packets from untrusted sources at upstream layer-3 devices where bridging is not required.
Avoid running the host as a Linux bridge on untrusted network segments until the fixed kernel is deployed.

bash

# Configuration example: disable IPv6 on a bridge and verify kernel version
sudo sysctl -w net.ipv6.conf.br0.disable_ipv6=1
uname -r
modinfo bridge | grep -E '^(filename|version)'