CVE-2026-31912: libpcap BPF Interpreter Buffer Overflow

CVE-2026-31912 Overview

CVE-2026-31912 is an out-of-bounds read vulnerability [CWE-125] in the libpcap Berkeley Packet Filter (BPF) interpreter. The interpreter fails to detect two boundary conditions: reaching the end of the filter program buffer without a return instruction, and executing a jump instruction whose offset points outside the buffer. A crafted filter program processed through pcap_offline_filter() can cause the interpreter to read process memory beyond the intended buffer. On 64-bit architectures, the read can span roughly 32 GiB around the buffer. On 32-bit architectures, the entire address space is reachable.

Critical Impact
A local attacker supplying a malicious BPF filter program can trigger arbitrary out-of-bounds memory reads, causing process crashes and availability loss in applications embedding libpcap.

Affected Products

libpcap (the-tcpdump-group) versions prior to the fix committed in d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9
Applications and tools linking against vulnerable libpcap builds that invoke pcap_offline_filter()
Downstream Linux and BSD distributions packaging affected libpcap releases

Discovery Timeline

2026-09-05 - CVE-2026-31912 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-31912

Vulnerability Analysis

The defect resides in the BPF interpreter path reached through pcap_offline_filter(). Before the fix, the interpreter accepted the filter program instruction buffer without also receiving the buffer length. As a result, the interpreter could not enforce program bounds when advancing the instruction pointer past the buffer end or when following a jump instruction with an offset that resolved outside the valid instruction array.

When a crafted BPF program lacks a terminating return instruction or contains a jump with an oversized offset, the interpreter continues fetching bytes from adjacent memory and executes them as BPF opcodes. The interpreter treats those bytes as valid instructions, including load operations that dereference computed pointers. On 64-bit systems, the reachable window is approximately 32 GiB surrounding the buffer. On 32-bit systems, the reachable region is the entire address space.

The primary impact is availability. Reads into unmapped memory produce a segmentation fault in the calling process, terminating any application performing offline packet filtering with attacker-supplied filters.

Root Cause

The pcapint_filter() helper accepted the instruction pointer bf_insns without the corresponding instruction count bf_len. Missing this length parameter, the interpreter could not validate that the program counter stayed within [bf_insns, bf_insns + bf_len) before each fetch or jump. This is a classic missing-bounds-check pattern that maps to [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires local access and the ability to supply a crafted BPF filter program to an application that calls pcap_offline_filter(). The attack does not require elevated privileges beyond those needed to invoke the affected application with a chosen filter. Because filter programs are typically supplied as user input to tools such as capture readers and analyzers, low-privileged local users may reach the vulnerable code path.

// Patch from dlpisubs.c - the caller now passes bf_len so the interpreter
// can enforce program bounds.
        bufp += caplen;
#endif
        ++pd->stat.ps_recv;
-       if (pcapint_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
+       if (pcapint_filter(p->fcode.bf_insns, p->fcode.bf_len,
+                          pk, origlen, caplen)) {
#ifdef HAVE_SYS_BUFMOD_H
            pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
            pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;

Source: libpcap commit d3f358d3

Detection Methods for CVE-2026-31912

Indicators of Compromise

Unexpected SIGSEGV terminations of processes linking libpcap and consuming user-supplied BPF filter expressions.
Core dumps whose faulting instruction resides inside pcapint_filter() or the BPF interpreter dispatch loop.
Application logs showing repeated crashes when parsing offline capture files or custom filter programs.

Detection Strategies

Inventory installed libpcap versions across Linux and BSD hosts and flag any build predating commit d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9.
Monitor for locally invoked packet analysis tools receiving BPF filter arguments from non-administrative users.
Correlate process crash events with the presence of untrusted .pcap inputs or externally provided filter strings.

Monitoring Recommendations

Forward auditd, systemd-coredump, and application crash telemetry to a centralized analytics platform for anomaly review.
Track invocation of tools such as tcpdump, tshark, and custom analyzers together with the calling user and supplied filter expression.
Alert on repeated abnormal terminations of the same libpcap-linked binary within short time windows on a single host.

How to Mitigate CVE-2026-31912

Immediate Actions Required

Upgrade libpcap to a release containing commit d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 and rebuild or repackage any statically linked consumers.
Restrict which local users may pass arbitrary BPF filter programs or offline capture files to libpcap-based tooling.
Audit in-house applications that call pcap_offline_filter() and confirm they pass a validated bf_len after upgrading to the patched API.

Patch Information

The fix updates pcapint_filter() to accept the instruction count bf_len alongside bf_insns, allowing the interpreter to enforce program bounds during execution and jump resolution. The CHANGES file records the fix as: CVE-2026-31912: Mind the program bounds in pcap_offline_filter(). Distribution maintainers should backport the change referenced in the upstream libpcap commit.

Workarounds

Do not accept BPF filter expressions or capture files from untrusted local users on affected hosts until patches are deployed.
Run packet analysis tools inside a sandbox or container with restricted memory and no access to sensitive process data.
Enforce mandatory access controls (SELinux, AppArmor) to limit which principals may execute libpcap-linked binaries.

bash

# Verify installed libpcap version and rebuild consumers after upgrade
ldconfig -p | grep libpcap
pkg-config --modversion libpcap
# Debian/Ubuntu
apt-get update && apt-get install --only-upgrade libpcap0.8 libpcap-dev
# RHEL/Fedora
dnf upgrade libpcap libpcap-devel