CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In the Linux kernel, the following vulnerability has been resolved:
seg6: separate dstcache for input and output paths in seg6 lwtunnel
The seg6 lwtunnel uses a single dstcache per encap route, shared between seg6inputcore() and seg6outputcore(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.
Fix this by splitting the cache into cacheinput and cacheoutput, so each path maintains its own cached dst independently.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31668?
The severity of CVE-2026-31668 is classified as moderate due to potential impact on the network functionality.
How do I fix CVE-2026-31668?
To fix CVE-2026-31668, update to a patched version of the Linux kernel that eliminates the vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-31668?
CVE-2026-31668 affects multiple versions of the Linux kernel prior to the release that includes the patch.
What types of attacks can exploit CVE-2026-31668?
CVE-2026-31668 could potentially be exploited by attackers to disrupt network traffic through the seg6 lwtunnel feature.
Is CVE-2026-31668 a local or remote vulnerability?
CVE-2026-31668 is primarily considered a remote vulnerability as it involves network communication paths.