CVE-2026-31752: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31752 is a buffer access vulnerability with incorrect length value in the Linux kernel's bridge module (br_nd_send() function) that can lead to denial of service. The function walks Neighbor Discovery (ND) options according to option-provided lengths without proper validation, allowing a malformed ND option to cause the parser to advance beyond the computed option span or read from a too-short source LLADDR option payload. Affected Linux kernel versions span from 4.15 through multiple stable branches up to 7.0-rc6, with patches available for versions 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-805 (Buffer Access with Incorrect Length Value). The br_nd_send() function in the Linux kernel bridge module iterates over Neighbor Discovery (ND) options using lengths supplied within the options themselves, without first validating those lengths against the remaining NS option area boundary. A crafted malformed ND option with an incorrect length field can cause the parser to read beyond the allocated buffer or access a source LLADDR option payload that is too short to contain a valid Ethernet address. The fix adds validation of option lengths against the remaining NS option area before advancing the parser, and enforces a minimum size check before reading the source LLADDR field (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation primarily impacts availability — an attacker on the same network segment can send malformed ND options to trigger out-of-bounds buffer access in the kernel, potentially causing kernel crashes (denial of service). There is also a secondary risk of sensitive kernel memory disclosure due to reads from incorrectly bounded memory regions. Integrity impact is considered low, and the vulnerability does not directly enable remote code execution based on current analysis (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access or presence on the same network segment as the target system (Red Hat CVE).

Apply the available kernel patches for the respective stable branches. Fixed versions include Linux kernel 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. As a network-level workaround, restrict access to systems running vulnerable kernel versions to limit exposure from adjacent network attackers. Monitor for unusual kernel crashes or error messages related to ND option processing in the bridge module (Red Hat Bugzilla, Amazon Linux Advisory).