Junglewise Threat Intelligence

CVE-2026-31752: Linux Kernel out-of-bounds read in bridge ND option parsing

CVE-2026-31752 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's network bridging component, which is also used in certain Siemens industrial controllers. An attacker could exploit this flaw to cause a system crash or denial-of-service by sending specially crafted network packets. This could disrupt industrial operations or corporate network connectivity depending on where the affected software is deployed.

Technical details

The vulnerability exists in the br_nd_send() function within net/bridge/br_arp_nd_proxy.c. The function iterates through Neighbor Discovery (ND) options based on lengths provided within the options themselves without sufficient validation. A malformed option with an invalid length can cause the parser to read beyond the allocated buffer or attempt to process a source Link-Layer Address (LLADDR) that is too short for an Ethernet address. This is a classic bounds-checking error that can result in a kernel panic (Denial of Service). The fix involves validating option lengths against the remaining option area and ensuring the LLADDR option is large enough for an Ethernet address before processing.

Affected products

  • Linux Linux Kernel Fixed in 259466f, 82a42ec, 837392a, 8508379, c49b925, e0bfd6d, e71303a, ee02d89
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-26: disclosed: Initial patch authored
  • 2026-05-01: advisory: CVE published
  • 2026-07-14: other: Siemens advisory added to record

References

Related threats