Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow a local user to crash the system. By sending specifically crafted network control messages, an attacker can trigger an internal error that leads to a kernel panic. This results in a complete denial of service, requiring a system reboot to recover.
Technical details
An integer overflow vulnerability exists in `ip6_datagram_send_ctl()` within the Linux kernel's IPv6 stack. The issue stems from a 16-bit length accumulator (`opt_flen`) that can wrap around when multiple `IPV6_DSTOPTS` control messages are provided in a single `sendmsg` call. Because the transmit path uses the wrapped (smaller) value to calculate buffer headroom while the actual push operation uses the original (larger) header size, it triggers an `skb_under_panic()` assertion. Exploitation requires `CAP_NET_RAW` privileges, which can be obtained by unprivileged users in environments where user namespaces are enabled. Patches have been released for various stable kernel branches to correctly adjust length accumulators when duplicate options are processed.
Affected products
- Linux Linux Kernel 5.11 to 5.15.203, 5.16 to 6.1.168, 6.13 to 6.18.22, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-01: patched: Initial patch submitted by Eric Dumazet
- 2026-04-13: advisory: CVE-2026-31415 published
References
- https://git.kernel.org/stable/c/0bdaf54d3aaddfe8df29371260fa8d4939b4fd6f
- https://git.kernel.org/stable/c/2dbfb003bbf3fc0e94f07efefab0ebcf83029a2a
- https://git.kernel.org/stable/c/4082f9984a694829153115d28c956a3534f52f29
- https://git.kernel.org/stable/c/4e453375561fc60820e6b9d8ebeb6b3ee177d42e
- https://git.kernel.org/stable/c/5e4ee5dbea134e9257f205e31a96040bed71e83f
- https://git.kernel.org/stable/c/63fda74885555e6bd1623b5d811feec998740ba4
- https://git.kernel.org/stable/c/872b74900d5daa37067ac676d9001bb929fc6a2a