CVE-2026-31752

Vulnerability

CVE-2026-31752 is a medium-severity vulnerability in the Linux kernel's bridge networking component. The function br_nd_send() processes Neighbor Discovery (ND) options by walking through them according to lengths provided within each option. The code failed to validate that these option lengths are within the bounds of the remaining ND option area, and also did not check that a source LLADDR LLADDR option is large enough to contain a full Ethernet address before reading it [1][2][3][4].

Exploitation

An attacker on the local network can send a crafted Neighbor Solicitation (NS) message with a malformed ND option that specifies an incorrect length. This can cause the parser to advance beyond the intended option span or to read from a too-short source LLADDR payload. No authentication is required, as the vulnerability is triggered code path is reachable from incoming ND messages processed by the bridge [1][2].

Impact

Successful exploitation can lead to an out-of-bounds read, potentially leaking kernel memory contents or causing a denial of service disruption. The CVSS v3 score of 5.5 reflects a medium severity, with the attack vector being adjacent network and no privileges required [1][2].

Mitigation

The fix was applied in the Linux kernel stable tree via commits that add proper length validation before advancing the option pointer and only reading the source LLADDR when the option is large enough for an Ethernet address [1][2][3][4]. Users should update to a kernel version containing these patches.