Security readout for executives and security teams
Plain-English summary
A Linux kernel IPv6 firewall matcher can access packet data as though a valid Ethernet header exists when it does not. The supplied CVSS score is 9.4, indicating potentially severe confidentiality, integrity, and availability consequences. Actual exposure depends on whether the affected ip6t_eui64 functionality is present and used.
Executive priority
Treat as urgent where affected IPv6 firewall functionality handles untrusted traffic. Patch through supported distribution channels after targeted testing. Do not infer fleet-wide exposure solely from the critical score; rapidly inventory matcher usage and kernel fix status to focus remediation.
Technical view
The eui64_mt6() matcher derives an EUI-64 identifier from an Ethernet source address. Its prior guard rejected an invalid MAC header only for nonzero fragment offsets, allowing other packets to reach eth_hdr(skb) without a valid MAC header. The fix rejects every packet lacking a valid MAC header before that access.
Likely exposure
Prioritize Linux systems using IPv6 netfilter rules involving ip6t_eui64, particularly where untrusted IPv6 traffic reaches them. The supplied affected-version data is ambiguous and lacks CPEs, so determine exposure from vendor advisories, kernel build provenance, module availability, active rules, and inclusion of the referenced stable fix.
Exploitation context
The bundle reports no CISA KEV listing and provides no cited evidence of active exploitation or a public exploit. Network attackability and low complexity are asserted by the supplied CVSS vector, but the sources do not establish a demonstrated attack path or required deployment conditions.
Researcher notes
The record supplies no CWE, CPE, crash trace, proof of concept, or exploitation evidence. Its version data contains repeated commit identifiers and does not clearly express branch boundaries. The correction is a guard-condition change backported across multiple stable branches. Validate branch ancestry and downstream package status before declaring a host vulnerable or fixed.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Confirm the selected kernel package maps to the correct maintained branch.
- Prioritize internet-facing or untrusted-network systems using the ip6t_eui64 matcher.
- If updating is delayed, review whether affected matcher rules can be safely disabled.
- Monitor Linux distribution guidance for branch-specific package and reboot requirements.
Validation and detection
- Record running kernel versions and distribution package revisions.
- Check whether the ip6t_eui64 functionality is available and actively referenced by firewall rules.
- Verify vendor advisories or package changelogs include the applicable stable commit.
- After updating, confirm systems booted into the corrected kernel.
- Reassess IPv6 traffic paths reaching hosts that use the matcher.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31685 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H3.95.5LinuxVulnerability scoring details
Base CVSS 3.1 score
9.4CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4d75bc2cd093bf5803edf512c099bfb220fd6459CVE reference, Linux
- https://git.kernel.org/stable/c/7d6a57411caf54df025860c9b1a82cd42d57a562CVE reference, Linux
- https://git.kernel.org/stable/c/d5603591373441fecf9951833d6d873e09320f08CVE reference, Linux
- https://git.kernel.org/stable/c/288138418bef956f8b295751a4536c60f0e89f4aCVE reference, Linux
- https://git.kernel.org/stable/c/9eda5478746ef7dc0e4e537b5a5e4b0ca1027091CVE reference, Linux
- https://git.kernel.org/stable/c/807d6ee15804df6f01a35c910f09612e858739a6CVE reference, Linux
- https://git.kernel.org/stable/c/309ae3e9a51a69699ca94eac5fac5688fa562d55CVE reference, Linux
- https://git.kernel.org/stable/c/fdce0b3590f724540795b874b4c8850c90e6b0a8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.