CVE-2026-31682
bridge: br_nd_send: linearize skb before parsing ND options
Description
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.
INFO
Published Date :
April 25, 2026, 9:16 a.m.
Last Modified :
May 6, 2026, 9:17 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Linearize the skb before parsing ND options.
- Derive ns from the linearized network header.
- Update the Linux kernel to the latest version.
Public PoC/Exploit Available at Github
CVE-2026-31682 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31682.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31682 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31682
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31682 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31682 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 06, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.22 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.81 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.134 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 5.10.253 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 25, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header. Added Reference https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd Added Reference https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053 Added Reference https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47 Added Reference https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55 Added Reference https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c Added Reference https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea Added Reference https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2 Added Reference https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662