CVE-2026-31415: linux kernel from 2.6.14 (inclusive), before 5.10.253 (exclusive), from 5.11 (inclusive), before 5.15.203 (exclusive)…

Affected technology

linux kernel · from 2.6.14 (inclusive), before 5.10.253 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.203 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.168 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.134 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.81 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.18.22 (exclusive)
linux

linux kernel · from 6.19 (inclusive), before 6.19.12 (exclusive)
linux

linux kernel · 7.0 · update rc1
linux

linux kernel · 7.0 · update rc2
linux

linux kernel · 7.0 · update rc3
linux

linux kernel · 7.0 · update rc4
linux

linux kernel · 7.0 · update rc5
linux

linux kernel · 7.0 · update rc6
linux

linux kernel · 7.0 · update rc7
linux

Linux · 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 2dbfb003bbf3fc0e94f07efefab0ebcf83029a2a, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 4082f9984a694829153115d28c956a3534f52f29, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 0bdaf54d3aaddfe8df29371260fa8d4939b4fd6f, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 5e4ee5dbea134e9257f205e31a96040bed71e83f, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 63fda74885555e6bd1623b5d811feec998740ba4, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 9ed81d692758dfb9471d7799b24bfa7a08224c31, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 872b74900d5daa37067ac676d9001bb929fc6a2a, 333fad5364d6b457c8d837f7d05802d2aaf8a961 to before 4e453375561fc60820e6b9d8ebeb6b3ee177d42e
Linux

Linux · 2.6.14
Linux

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

Component: Not specified by the source
File: net/ipv6/datagram.c

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source says when building the final skb, the actual push length comes from `dst1opt` and is not limited by wrapped `opt_flen`: - In `net/ipv6/ip6_output.c:1930-1934`: - `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);` - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes `dst1opt` via `ipv6_push_exthdr()`. - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does: - `skb_push(skb, ipv6_optlen(opt));` - `memcpy(h, opt, ipv6_optlen(opt));` With insufficient headroom, `skb_push()` underflows and triggers `skb_under_panic()` -> `BUG()`: - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`) - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`) - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`). - Root (or any task with `CAP_NET_RAW`) can trigger this without user namespaces. - An unprivileged `uid=1000` user can trigger this if unprivileged user namespaces are enabled and it can create a userns+netns to obtain namespaced `CAP_NET_RAW` (the attached PoC does this). - Local denial of service: kernel BUG/panic (system crash). - ---truncated---. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high.