LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux network-bridge flaw can make the kernel access data beyond the available linear packet buffer while processing IPv6 Neighbor Discovery options. The supplied CVSS assessment indicates potentially serious information exposure and system disruption. The source bundle does not establish active exploitation, and its affected-version information requires vendor confirmation.

Executive priority

Treat this as an urgent patch-validation issue for network infrastructure, virtualization hosts, and appliances using Linux bridging. Accelerate inventory and vendor-supported updates because exploitation requires neither privileges nor user action under the supplied CVSS assessment. Absence from KEV reduces evidence of immediate widespread attacks but does not reduce the technical severity.

Technical view

Linux br_nd_send() parses IPv6 Neighbor Discovery options from ns->opt[] without ensuring the complete option area is linear. Callers guarantee only the ICMPv6 header and target address, allowing access past the linear buffer. The upstream correction linearizes the socket buffer before parsing and derives ns again from the linear network header.

Likely exposure

Potentially exposed assets are Linux systems or appliances using network bridging and processing IPv6 Neighbor Discovery on affected kernels. CVSS classifies the attack vector as network-accessible without privileges or user interaction. Practical reachability depends on network topology and configuration. The supplied version entries do not clearly define complete affected release ranges.

Exploitation context

CISA KEV status is false, and the bundle provides no evidence of active exploitation or a public exploit. The 9.1 CVSS vector indicates high confidentiality and availability impact, with no scored integrity impact. Treat the rating seriously while distinguishing theoretical severity from confirmed attacks.

Researcher notes

The affected-version data is ambiguous: it contains repeated commit identifiers, isolated releases, and no dependable range semantics. Validate distributor backports through advisories and commit ancestry. The bundle supplies no CWE, exploit evidence, crash trace, or proof of practical information disclosure. Siemens advisories are referenced, but their affected-product details are not reproduced here.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable referenced stable fix.
  • Consult Linux distributor and Siemens advisories for product-specific fixed releases and deployment guidance.
  • Prioritize bridged IPv6 hosts and appliances while exact affected-version boundaries are confirmed.
  • If patching is delayed, request supported vendor mitigations; none are named in the supplied bundle.

Validation and detection

  • Inventory kernel builds on systems using Linux bridging and IPv6 Neighbor Discovery.
  • Map each build to distributor advisories or the referenced stable-kernel correction commits.
  • Confirm the deployed kernel includes the applicable correction; version strings alone may be insufficient.
  • Review kernel crash and memory-fault telemetry, recognizing that findings would not independently prove exploitation.
  • Retest bridge and IPv6 Neighbor Discovery functionality after updating.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31682 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-31682Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30, ed842faeb2bd49256f00485402f3113205f91d30unaffected
LinuxLinux4.15, 0, 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.