CVE-2026-31738
vxlan: validate ND option lengths in vxlan_na_create
Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
INFO
Published Date :
May 1, 2026, 3:16 p.m.
Last Modified :
May 7, 2026, 6:58 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Validate option lengths against remaining NS option area.
- Read source LLADDR only if option is large enough.
- Apply kernel patches that fix vxlan_na_create.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31738.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31738 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31738
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31738 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31738 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:3.14:rc8:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.22 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.14.1 up to (excluding) 5.10.253 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.168 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.81 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.134 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.12.18 up to (excluding) 3.13 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.13.10 up to (excluding) 3.14 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 01, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address. Added Reference https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500 Added Reference https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7 Added Reference https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958 Added Reference https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385 Added Reference https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1 Added Reference https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b Added Reference https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3 Added Reference https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679