PT-2026-32341 · Linux · Linux Kernel

Yiming Qian · Published 2026-04-13 · Updated 2026-05-03 · CVE-2026-31415

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IPv6 sendmsg ancillary-data path where a mismatch occurs between a 16-bit length accumulator opt flen and a pointer to the last provided destination-options header dst1opt when multiple IPV6 DSTOPTS control messages are provided. The function ip6 datagram send ctl() accepts repeated IPV6 DSTOPTS and increments opt flen without rejecting duplicates, allowing the 16-bit value to wrap around. Consequently, the transmit path underestimates the required headroom. When the final socket buffer is built, the actual push length is derived from dst1opt rather than the wrapped opt flen, leading to a buffer underflow in skb push() that triggers a kernel panic. This can be exploited by a local user with CAP NET RAW privileges, or an unprivileged user if unprivileged user namespaces are enabled, resulting in a local denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-31415

ECHO-2E4A-F19E-BFAD

OESA-2026-2172

OESA-2026-2173

OESA-2026-2176

Affected Products

Linux Kernel

References · 47

• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23455 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2172 · Vendor Advisory
• https://git.kernel.org/stable/c/63fda74885555e6bd1623b5d811feec998740ba4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23452 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23447 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23449 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31415 · Vendor Advisory
• https://git.kernel.org/stable/c/5e4ee5dbea134e9257f205e31a96040bed71e83f · Patch
• https://git.kernel.org/stable/c/9ed81d692758dfb9471d7799b24bfa7a08224c31 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31415 · Security Note