CVE-2026-31685

netfilter: ip6t_eui64: reject invalid MAC header for all packets

State: Published
Severity: 9.4 Critical
Published: Apr 25, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_eui64: reject invalid MAC header for all packets

`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address.

The existing guard only rejects an invalid MAC header when `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` can still reach `eth_hdr(skb)` even when the MAC header is not valid.

Fix this by removing the `par->fragoff != 0` condition so that packets with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.

Scores

CVSS	Score	Vector	Source
3.1	9.4 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4d75bc2cd093bf5803edf512c099bfb220fd6459Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d6a57411caf54df025860c9b1a82cd42d57a562Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d5603591373441fecf9951833d6d873e09320f08Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 288138418bef956f8b295751a4536c60f0e89f4aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9eda5478746ef7dc0e4e537b5a5e4b0ca1027091Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 807d6ee15804df6f01a35c910f09612e858739a6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 309ae3e9a51a69699ca94eac5fac5688fa562d55Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fdce0b3590f724540795b874b4c8850c90e6b0a8Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4d75bc2cd093bf5803edf512c099bfb220fd6459Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7d6a57411caf54df025860c9b1a82cd42d57a562Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d5603591373441fecf9951833d6d873e09320f08Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 288138418bef956f8b295751a4536c60f0e89f4aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9eda5478746ef7dc0e4e537b5a5e4b0ca1027091Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 807d6ee15804df6f01a35c910f09612e858739a6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 309ae3e9a51a69699ca94eac5fac5688fa562d55Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fdce0b3590f724540795b874b4c8850c90e6b0a8Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.