CVE-2026-31752: bridge: br_nd_send: validate ND option lengths
In the Linux kernel, the following vulnerability has been resolved:
bridge: brndsend: validate ND option lengths
brndsend() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the primary impact if exploitation succeeds?
The reported impact is on availability only, with high availability impact and no reported confidentiality or integrity impact.
What malformed input is involved?
The issue involves malformed IPv6 Neighbor Discovery options whose declared lengths can exceed the remaining Neighbor Solicitation option area, or source link-layer address options too short to contain an Ethernet address.