CVE-2026-31752: bridge: br_nd_send: validate ND option lengths
Published May 1, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
bridge: brndsend: validate ND option lengths
brndsend() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
Affected Software
14 affected components
Linux Linux kernel
Linux Linux kernel>=4.15<5.10.253
Linux Linux kernel>=5.11<5.15.203
Linux Linux kernel>=5.16<6.1.168
Linux Linux kernel>=6.2<6.6.134
Linux Linux kernel>=6.7<6.12.81
Linux Linux kernel>=6.13<6.18.22
Linux Linux kernel>=6.19<6.19.12
Linux Linux kernel=7.0-rc1
Linux Linux kernel=7.0-rc2
Linux Linux kernel=7.0-rc3
Linux Linux kernel=7.0-rc4
Linux Linux kernel=7.0-rc5
Linux Linux kernel=7.0-rc6
Event History
May 1, 2026
CVE Published
via MITRE·02:14 PM
Data Sourced
via MITRE·02:14 PM
Description
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityAffected Software