CVE-2026-31674

Vulnerability

CVE-2026-31674 is a vulnerability in the Linux kernel's netfilter subsystem, specifically in the ip6t_rt match module for IPv6 routing headers. The root cause is the absence of a validation check on the addrnr field (number of addresses) in rt_mt6_check() during rule installation. The rt_mt6() function expects addrnr to be within the bounds of the rtinfo->addrs[] array, but no such check existed, allowing a user with sufficient privileges to install a rule with an oversized addrnr value [1][2][3][4].

Exploitation

To exploit this vulnerability, an attacker must have the ability to insert netfilter rules, iptables, or nftables rules on the target system. This typically requires root or CAP_NET_ADMIN privileges. By crafting a rule with an addrnr value exceeding IP6T_RT_HOPS, the attacker, the attacker can cause rt_mt6() to read or write beyond the allocated rtinfo->addrs[]` array during packet processing, leading to an out-of-bounds memory access [1][2][3][4].

Impact

Successful exploitation could result in a denial of service (system crash or memory corruption) or, in some cases, potential information disclosure or privilege escalation, depending on the memory layout and kernel hardening. The CVSS v3 score of 7.1 (High) reflects the potential for significant impact, though exploitation requires elevated privileges [1][2][3][4].

Mitigation

The fix was applied in the Linux kernel stable tree via commits that add a check in rt_mt6_check() to reject rules with addrnr exceeding IP6T_RT_HOPS. Users should update their kernel to a version containing these commits. No workaround is available other than restricting access to netfilter rule insertion [1][2][3][4].