CVE-2026-31495: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31495 is an improper input validation vulnerability in the Linux kernel's netfilter ctnetlink subsystem. It affects the handling of several netlink attributes — including CTA_PROTOINFO_TCP_STATE, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY, CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS, and CTA_EXPECT_FLAGS — which lacked proper netlink policy range checks, allowing invalid values to bypass early rejection. The vulnerability was disclosed on April 22, 2026, and affects Linux kernel versions from 2.6.22 up through multiple stable branches (fixed in 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0). It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1287 (Improper Validation of Specified Type of Input). The ctnetlink code paths in the Linux kernel's netfilter subsystem performed manual range and mask validations rather than using netlink policy annotations, allowing the netlink core to accept out-of-range values. Most critically, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY accepted values 0–255 instead of the valid range 0–14 (TCP_MAX_WSCALE); when these values were used as a u32 shift count, undefined behavior could result. Similarly, CTA_PROTOINFO_TCP_STATE lacked policy-level rejection of values exceeding TCP_CONNTRACK_SYN_SENT2, and filter/expect flag attributes were missing mask-based validation. The fix replaces manual checks with NLA_POLICY_RANGE and NLA_POLICY_MASK annotations so the netlink core rejects invalid values early and generates extack errors (GitHub Advisory).

Successful exploitation could cause undefined behavior in kernel memory operations due to improper shift counts derived from out-of-range TCP window scale values, potentially leading to kernel instability or denial of service. Improper TCP state validation could allow malformed connection tracking parameters to corrupt connection state in the netfilter subsystem. The vulnerability has no confidentiality or integrity impact per its CVSS assessment; the primary risk is availability (kernel crash or instability) on affected systems (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires local access with low privileges (e.g., the ability to send netlink messages, typically requiring CAP_NET_ADMIN or access to a user namespace with netlink capabilities). The EPSS score is approximately 0.028% (very low probability of exploitation in the near term). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

Update the Linux kernel to a patched version released on or after April 22, 2026. Fixed versions include: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0 (stable). Patches are available via the upstream kernel stable tree. As a workaround where patching is not immediately possible, restrict access to netlink sockets and limit CAP_NET_ADMIN capabilities to trusted processes; consider restricting user namespaces if not required. Amazon Linux 2023 advisories (ALAS2023-2026-1646, ALAS2023-2026-1681) and Debian stable updates also include the fix (GitHub Advisory, Amazon Linux Advisory).