CVE-2026-31668: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31668 is a Linux kernel vulnerability in the seg6 lwtunnel subsystem caused by incorrect synchronization of a shared destination cache between input and output routing paths. The flaw was disclosed on April 24, 2026, and affects Linux kernel versions from 4.10.1 through 6.19.12 across multiple stable branches. It carries a CVSS v3.1 base score of 9.8 (Critical), though this score appears to reflect an automated estimate rather than a fully reviewed NVD assessment (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-821 (Incorrect Synchronization). The seg6 lwtunnel implementation maintains a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). Because these two code paths can operate in different routing contexts — such as IP rules matching on ingress interfaces or VRF table separation — whichever path executes first populates the cache, and the other blindly reuses it, bypassing its own routing lookup. The fix splits the cache into separate cache_input and cache_output fields so each path maintains an independent cached destination (GitHub Advisory, Kernel Patch).

Exploitation of this vulnerability could allow a network-accessible attacker to redirect IPv6 traffic through unintended routing paths or VRF tables in SRv6 (Segment Routing v6) configurations. This may result in unauthorized access to otherwise isolated network segments, exposure of sensitive traffic to unintended paths, and circumvention of network segmentation policies enforced via IP rules or VRF separation. Confidentiality, integrity, and availability are all potentially affected, as traffic can be misdirected, intercepted, or disrupted (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is network-accessible and requires no privileges or user interaction, which elevates theoretical risk for systems running SRv6/seg6 lwtunnel configurations exposed to untrusted networks.

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to one of the following fixed versions: 5.10.253+, 5.15.203+, 6.1.169+, 6.6.135+, 6.12.82+, 6.18.23+, 6.19.13+, or 7.0-rc1+. Multiple upstream kernel commits address the issue (Kernel Patch, Kernel Patch). As an interim measure, systems not using SRv6 or seg6 lwtunnel functionality can disable or avoid configuring those features, and network access controls should be applied to limit exposure to untrusted networks. Distribution-specific updates are available from Amazon Linux (ALAS2KERNEL-5.15-2026-102) and SUSE (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) (Amazon Linux, SUSE Advisory).

The vulnerability was announced via the Linux kernel CVE mailing list and picked up by standard vulnerability tracking services shortly after disclosure (Kernel Announce). Tenable released Nessus detection plugins (IDs 310506, 318240, 318288, 319659) for the vulnerability. No notable independent researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking.