Out-of-bounds read in Linux kernel - CVE-2026-31752
Published: May 2, 2026
Vulnerability identifier: #VU128936
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-31752
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in br_nd_send when parsing malformed neighbor discovery options. A remote attacker can send a specially crafted neighbor solicitation packet to cause a denial of service.
How to mitigate CVE-2026-31752
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/259466f76f5a2148aff11134e68f4b4c6d52725b
- https://git.kernel.org/stable/c/82a42eceec7c6bdb0e0da94c0542a173b7ea57f2
- https://git.kernel.org/stable/c/837392a38445729c22e03d3abcf33f07763efd85
- https://git.kernel.org/stable/c/850837965af15707fd3142c1cf3c5bfaf022299b
- https://git.kernel.org/stable/c/c49b9256bbacb6a135654aebd12e4c0e87166b7c
- https://git.kernel.org/stable/c/e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa
- https://git.kernel.org/stable/c/e71303a9190496136e240c4f2872b7b0b16027a7
- https://git.kernel.org/stable/c/ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a