ipv6: avoid overflows in ip6_datagram_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via `skb_under_panic()` (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type `__u16`) and - a pointer to the *last* provided destination-options header (`opt->dst1opt`) when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided. - `include/net/ipv6.h`: - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible). (lines 291-307, especially 298) - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`: - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen` without rejecting duplicates. (lines 909-933) - `net/ipv6/ip6_output.c:__ip6_append_data()`: - Uses `opt->opt_flen + opt->opt_nflen` to compute header sizes/headroom decisions. (lines 1448-1466, especially 1463-1465) - `net/ipv6/ip6_output.c:__ip6_make_skb()`: - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero. (lines 1930-1934) - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`: - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the pointed-to header). (lines 1179-1185 and 1206-1211) 1. `opt_flen` is a 16-bit accumulator: - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`. 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_D
CVE-2026-31415
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31415
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "2dbfb003bbf3fc0e94f07efefab0ebcf83029a2a",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "4082f9984a694829153115d28c956a3534f52f29",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "0bdaf54d3aaddfe8df29371260fa8d4939b4fd6f",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "5e4ee5dbea134e9257f205e31a96040bed71e83f",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "63fda74885555e6bd1623b5d811feec998740ba4",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "9ed81d692758dfb9471d7799b24bfa7a08224c31",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "872b74900d5daa37067ac676d9001bb929fc6a2a",
"versionType": "git"
},
{
"status": "affected",
"version": "333fad5364d6b457c8d837f7d05802d2aaf8a961",
"lessThan": "4e453375561fc60820e6b9d8ebeb6b3ee177d42e",
"versionType": "git"
}
],
"programFiles": [
"net/ipv6/datagram.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv6/datagram.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31415
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #28268 · Revision 1
- Added to Heist Feed
- Publisher date