Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-lifetime error can let a low-privileged local user trigger a race involving IPv6 flow labels and a procfs reader. The documented outcome is a kernel crash, potentially disrupting the host. Although the CVSS assessment lists broader impact, the supplied technical description does not establish data theft, modification, or privilege escalation.
Executive priority
Treat this as a high-priority local denial-of-service risk, especially on multi-user, hosting, container, or appliance environments. Schedule kernel updates through normal emergency-patching controls. Immediate isolation is not supported by the supplied evidence unless crashes or suspicious local activity are observed.
Technical view
An exclusive IPv6 flow label can free its option block when its user count reaches zero, while the enclosing flow-label object remains visible under RCU. A concurrent /proc/net/ip6_flowlabel reader may dereference that freed block in ip6fl_seq_show(), causing a use-after-free and crash. The fix defers freeing the options until RCU teardown.
Likely exposure
Exposure is limited to affected Linux kernel builds where a low-privileged local actor can exercise IPv6 flow-label behavior. The supplied version data is ambiguous, so determine status through distribution advisories, package changelogs, or the listed stable-kernel fixes. The sources do not demonstrate remote reachability.
Exploitation context
The CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. The documented demonstrated effect is a kernel crash.
Researcher notes
The central issue is mismatched lifetimes between fl->opt and struct ip6_flowlabel under RCU visibility. Researchers should distinguish the documented use-after-free crash from the CVSS vector's theoretical confidentiality and integrity impacts. The supplied material does not prove controlled memory corruption, privilege escalation, remote attackability, or exploitation in the wild.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix or downstream backport.
- Consult Linux distribution and appliance-vendor advisories for package-specific fixed versions.
- Prioritize shared systems where untrusted or low-privileged users can execute local workloads.
- Apply normal access controls while patching; the sources name no configuration-based workaround.
Validation and detection
- Inventory running kernel and distribution package versions across Linux hosts and appliances.
- Compare each package against vendor advisories and the listed upstream stable fixes.
- Verify the relevant fix commit or documented downstream backport is present.
- Review kernel crash records for faults involving ip6fl_seq_show or IPv6 flow-label handling.
- After updating, confirm hosts booted into the remediated kernel rather than an older installed build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31680 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3CVE reference, Linux
- https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827CVE reference, Linux
- https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fdCVE reference, Linux
- https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8CVE reference, Linux
- https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249bCVE reference, Linux
- https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342aCVE reference, Linux
- https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4CVE reference, Linux
- https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.