CVE-2026-31407: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31407 is a missing netlink policy validation vulnerability in the Linux kernel's netfilter conntrack subsystem, allowing local low-privileged users to trigger out-of-bounds memory reads and writes. Reported by researcher Hyunwoo Kim, it was published on April 6, 2026, and affects Linux kernel versions from 2.6.27 up to (but not including) 6.6.136, 6.7–6.12.83, 6.13–6.18.24, and 6.19–6.19.10, as well as 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is missing input validation in the Linux kernel's netfilter connection tracking (conntrack) netlink interface, classified as CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Specifically, nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE attribute directly to ct->proto.sctp.state without range checking, and an unvalidated connection direction value (exp->dir = 100) causes ct->master->tuplehash[100] to read 5,600 bytes past the start of a 320-byte nf_conn object — a slab-out-of-bounds access confirmed by UBSAN. Exploitation requires a local user with low privileges who can send crafted netlink messages to the netfilter subsystem. The fix extends the netlink policies to enforce valid attribute ranges (GitHub Advisory, Red Hat Bugzilla).

A local attacker with low privileges can read up to 5,600 bytes of sensitive kernel heap memory by crafting malicious netlink messages with invalid SCTP conntrack attributes, resulting in high confidentiality impact. The out-of-bounds write component also poses a high availability risk, potentially causing kernel crashes or memory corruption. Integrity is not directly impacted, but kernel memory disclosure could facilitate further privilege escalation or information leakage (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.6.136 or later (for 6.6.x branch), 6.12.83 or later (for 6.12.x), 6.18.24 or later (for 6.18.x), 6.19.10 or later (for 6.19.x), or 7.0-rc5 or later. Debian has released linux 6.12.85 into stable-security and proposed-updates. SUSE has issued advisories SUSE-SU-2026:2068-1, SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, and SUSE-SU-2026:2238-1. As a workaround where patching is not immediately possible, restrict unprivileged access to netlink sockets used for netfilter configuration (e.g., via seccomp, AppArmor, or SELinux policies) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher Hyunwoo Kim, who provided detailed technical analysis of both the SCTP state and connection direction out-of-bounds access paths. Red Hat triaged the issue at medium severity and opened a tracking bug. The Yocto Project security team also issued multiple advisories tracking the fix across their supported kernel versions. No significant broader media coverage or notable social media discussion beyond automated CVE notification accounts has been observed (Red Hat Bugzilla).