CVE-2026-31682
bridge: br_nd_send: linearize skb before parsing ND options
Description
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.
INFO
Published Date :
April 25, 2026, 9:16 a.m.
Last Modified :
April 25, 2026, 9:16 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-31682
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Linearize the skb before parsing ND options.
- Derive ns from the linearized network header.
- Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31682.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31682 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31682
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31682 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31682 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 25, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header. Added Reference https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd Added Reference https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053 Added Reference https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47 Added Reference https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55 Added Reference https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c Added Reference https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea Added Reference https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2 Added Reference https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662