Skip to content
Heist/ feed
Back to feed
CriticalFix available

bridge: br_nd_send: linearize skb before parsing ND options

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.253, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134
CVEs
CVE-2026-31682
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 04:43 UTC · Revision 1

Source evidence

bridge: br_nd_send: linearize skb before parsing ND options

core-osv · Original source

Published 25 Apr 2026, 08:46 UTC

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

osv:CVE-2026-31682

Kernel

Fixed versions: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12

Complete source record
{
  "id": "a8435c6a432c94f0c15447bfe03338ed3ec09b38f9de217abb9fd53f6fd27a86",
  "url": "https://osv.dev/vulnerability/CVE-2026-31682",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "bridge: br_nd_send: linearize skb before parsing ND options",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.",
    "evidence": "osv:CVE-2026-31682",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.253",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.203",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.168",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.134",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.81",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.22",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.12",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-31682",
      "aliases": [
        "CVE-2026-31682"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "ed842faeb2bd49256f00485402f3113205f91d30"
                },
                {
                  "fixed": "c68433fd291c9e88c00292095172c62d1997d662"
                },
                {
                  "fixed": "4f397b950c916e9a1f8a4fce04ea0110206cad47"
                },
                {
                  "fixed": "bd91ec85aa4c77d645bd2739fc56784157a88ca2"
                },
                {
                  "fixed": "658261898130da620fc3d0fbb0523efb3366cb55"
                },
                {
                  "fixed": "2ba4caba423ed94d63006eb1d2227b0332ab7fcd"
                },
                {
                  "fixed": "9c55e41c73af5c4511070933b1bd25248521270c"
                },
                {
                  "fixed": "3a30f6469b058574f49efde61cd6f5d79e576053"
                },
                {
                  "fixed": "a01aee7cafc575bb82f5529e8734e7052f9b16ea"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31682.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.15.0"
                },
                {
                  "fixed": "5.10.253"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.203"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.168"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.134"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.81"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.22"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "6.19.12"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31682.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.708389083Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
        "https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd",
        "https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053",
        "https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47",
        "https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55",
        "https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c",
        "https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea",
        "https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2",
        "https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31682.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-31682",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31682.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-31682",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492530,
  "published_at": "2026-04-25T08:46:59.106+00:00"
}