CVE-2026-31531: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31531 is a denial-of-service vulnerability in the Linux kernel's IPv4 nexthop handling, caused by an incorrect buffer size calculation (CWE-131) in the rtm_get_nexthop() function. When querying a nexthop object via RTM_GETNEXTHOP, the kernel allocates a fixed-size socket buffer (NLMSG_GOODSIZE) that is insufficient for large Equal-Cost Multi-Path (ECMP) groups (e.g., 512 nexthops), triggering a kernel warning splat and potential system instability. Affected versions include Linux kernel 5.3 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0-rc1 through 7.0-rc7. It was published on April 23, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect buffer size calculation (CWE-131) in net/ipv4/nexthop.c. The rtm_get_nexthop() function allocates a fixed-size skb using NLMSG_GOODSIZE, which is adequate for small nexthop groups but overflows when handling large ECMP groups such as those with 512 members. The fix involves dynamically allocating the skb size using nh_nlmsg_size() and nlmsg_new(), consistent with the behavior of nexthop_notify(), and also corrects nh_nlmsg_size_grp() to account for flags and the previously missing NHA_FDB size. Exploitation requires a local attacker with low privileges to send a crafted RTM_GETNEXTHOP netlink message targeting a large nexthop group (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel warning splat and potential system crash or instability, resulting in a denial-of-service condition. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems include any Linux host running a vulnerable kernel version where a low-privileged local user has access to network namespaces and can issue netlink queries (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (1st percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface (GitHub Advisory).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log referencing WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0 with associated call traces through rtnetlink_rcv_msg, netlink_rcv_skb, and netlink_sendmsg.
• Process: Unusual or repeated netlink socket activity (RTM_GETNEXTHOP queries) from low-privileged processes, particularly those querying large nexthop groups.
• Network: Abnormal volume of RTM_GETNEXTHOP netlink messages observable via tools such as ss or strace on suspicious processes.

Upgrade to a patched Linux kernel version: 6.12.83 or later, 6.18.24 or later, or 6.19.14 or later. Official kernel patches are available via four stable branch commits: 14cf0cd35361f4e94824bf8a42f72713d7702a73, 40bd39e383a0478fd5c221f393df05fd9d70cfbc, 615517f3f8d53b0cf41507c7599971e17adfdfa5, and 635038fe19db391117e66b46bdc2b6e447ac801d. As a workaround, restrict network namespace access to trusted users only to reduce exposure. Distribution-specific updates are available through Debian (linux 6.19.14-1, 6.12.85+1) and other downstream vendors (GitHub Advisory, Red Hat Bugzilla).