CVE-2026-31674: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31674 is a Linux kernel vulnerability in the netfilter ip6t_rt module where the addrnr parameter is not validated during IPv6 routing rule installation, allowing it to exceed the IP6T_RT_HOPS bounds and cause an out-of-bounds array access in rtinfo->addrs[]. The vulnerability affects the Linux kernel from version 2.6.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, and 6.19.11. It was published on April 25, 2026, with patches made available in the upstream kernel shortly thereafter. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input): the rt_mt6_check() function, called during netfilter rule installation, fails to reject addrnr values that exceed IP6T_RT_HOPS, the defined upper bound for the rtinfo->addrs[] array. When the rule is subsequently evaluated by rt_mt6(), the unvalidated addrnr is used as an array index, resulting in an out-of-bounds memory read. Exploitation requires local access and the ability to install netfilter rules (typically requiring CAP_NET_ADMIN or equivalent privileges). The fix adds a bounds check in rt_mt6_check() to reject malformed rules before they can be stored and later used by the match logic (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can lead to out-of-bounds kernel memory access, potentially resulting in kernel memory corruption, denial of service via kernel crash, or privilege escalation depending on the memory layout at the time of exploitation. The confidentiality impact is rated High (kernel memory disclosure) and availability impact is rated High (potential kernel crash), while integrity is not directly affected. Because exploitation requires local access with netfilter rule installation privileges, the blast radius is limited to the affected host, though privilege escalation could enable further lateral movement (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (GitHub Advisory). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Apply the upstream Linux kernel patches that add addrnr bounds validation in rt_mt6_check(). Fixed versions are available across multiple stable branches: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, and 6.19.11. As a workaround, restrict local access to netfilter rule installation capabilities (e.g., limit CAP_NET_ADMIN to trusted users/containers) to reduce exposure until a patched kernel can be deployed. Amazon Linux 2 users should refer to ALAS2KERNEL-5.15-2026-102, and Debian users should update to the patched kernel packages available in the security repository (GitHub Advisory, Red Hat, Amazon Linux Advisory).

Red Hat has acknowledged the vulnerability and assigned it a moderate severity rating, tracking it via Bugzilla (Red Hat Bugzilla). The Linux kernel security team announced the CVE via the linux-cve-announce mailing list on April 25, 2026. Tenable has published Nessus detection plugins (IDs 310336 and 318288) for the vulnerability. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking.