CVE-2026-31685

CRITICAL 9.4

netfilter: ip6t_eui64: reject invalid MAC header for all packets

CVSS Score

9.4

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The existing guard only rejects an invalid MAC header when `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` can still reach `eth_hdr(skb)` even when the MAC header is not valid. Fix this by removing the `par->fragoff != 0` condition so that packets with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Apr 25, 2026
Last Updated	Jun 1, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new critical vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linux / Linux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4d75bc2cd093bf5803edf512c099bfb220fd6459 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7d6a57411caf54df025860c9b1a82cd42d57a562 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d5603591373441fecf9951833d6d873e09320f08 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 288138418bef956f8b295751a4536c60f0e89f4a 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9eda5478746ef7dc0e4e537b5a5e4b0ca1027091 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 807d6ee15804df6f01a35c910f09612e858739a6 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 309ae3e9a51a69699ca94eac5fac5688fa562d55 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fdce0b3590f724540795b874b4c8850c90e6b0a8

Linux / Linux

2.6.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗