Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s Open vSwitch component allowed malformed MPLS action data to pass validation even though later processing expected a fixed-size structure. A local, low-privileged attacker could potentially cause serious confidentiality loss or system disruption. The published CVSS score is 7.1.
Executive priority
Prioritize exposed multi-user, virtualization, container, and software-defined networking hosts using kernel Open vSwitch. Treat remediation as high priority, but verify vendor package status before emergency action because the supplied affected-version mapping is unclear and no active exploitation is documented.
Technical view
Open vSwitch validation treated OVS_KEY_ATTR_MPLS payloads for SET and SET_MASKED actions as variable length. Subsequent action handling expected struct ovs_key_mpls, creating unsafe processing when lengths differed. The kernel fix uses the normalized key length, including masked actions, and rejects invalid MPLS payload sizes before action handling.
Likely exposure
Exposure is most plausible on affected Linux systems using the kernel Open vSwitch datapath, particularly where local low-privileged users or processes can reach relevant OVS action interfaces. The supplied version data is ambiguous and includes duplicated commit identifiers, so distribution-specific package status should determine actual exposure.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality and availability impact. The source bundle says this CVE is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The record provides no CWE and does not describe the precise memory-safety failure or observed crash behavior. Multiple stable-kernel commits are referenced, apparently covering supported branches. The affected-version data contains unusual entries and repeated hashes; researchers should rely on branch-specific commits and vendor backport records rather than raw version strings alone.
Mitigation direction
- Install a vendor kernel update containing the applicable referenced stable fix.
- Reboot into the updated kernel and confirm the running version changed.
- Check distribution security guidance for backport status and affected package versions.
- Where operationally feasible, reduce local access to systems using kernel Open vSwitch.
Validation and detection
- Inventory systems loading or using the kernel Open vSwitch datapath.
- Record running kernel versions and distribution package release identifiers.
- Compare each package against vendor advisories or documented backported fix commits.
- Confirm the updated kernel is active after reboot, not merely installed.
- Review monitoring for unusual local crashes or OVS-related kernel faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31679 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/68f32ef0683c8d1c05cd2e4f16818fa63ff59c6fCVE reference, Linux
- https://git.kernel.org/stable/c/4cae986225f8b8679ad86b924918e7d75a96aa61CVE reference, Linux
- https://git.kernel.org/stable/c/8ed7b9930cbc3bc71f868fa79a68700ac88d586aCVE reference, Linux
- https://git.kernel.org/stable/c/c1f97152df8dfb17e855ddf0fc409b7bd13e9700CVE reference, Linux
- https://git.kernel.org/stable/c/98de18d327ef8cbbb704980e359e4872d8c28997CVE reference, Linux
- https://git.kernel.org/stable/c/bd50c7484c3bb34097571c1334174fb8b7408036CVE reference, Linux
- https://git.kernel.org/stable/c/2ca33b88a79ca42f017ae0f7011280325655438eCVE reference, Linux
- https://git.kernel.org/stable/c/546b68ac893595877ffbd7751e5c55fd1c43ede6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.