CyberSecBulletin
CVE-2026-31682NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-31682 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions c68433fd291c9e88c00292095172c62d1997d662, 4f397b950c916e9a1f8a4fce04ea0110206cad47, bd91ec85aa4c77d645bd2739fc56784157a88ca2 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.64% chance of exploitation within 30 days, higher than 51% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to c68433fd291c9e88c00292095172c62d1997d662 or 4f397b950c916e9a1f8a4fce04ea0110206cad47 or bd91ec85aa4c77d645bd2739fc56784157a88ca2 or 658261898130da620fc3d0fbb0523efb3366cb55, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.134, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, c68433fd291c9e88c00292095172c62d1997d662; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, 4f397b950c916e9a1f8a4fce04ea0110206cad47; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, bd91ec85aa4c77d645bd2739fc56784157a88ca2; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, 658261898130da620fc3d0fbb0523efb3366cb55; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, 2ba4caba423ed94d63006eb1d2227b0332ab7fcd; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, 9c55e41c73af5c4511070933b1bd25248521270c; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, 3a30f6469b058574f49efde61cd6f5d79e576053; ed842faeb2bd49256f00485402f3113205f91d30 up to, but not including, a01aee7cafc575bb82f5529e8734e7052f9b16ea; and 1 more rangesc68433fd291c9e88c00292095172c62d1997d662, 4f397b950c916e9a1f8a4fce04ea0110206cad47, bd91ec85aa4c77d645bd2739fc56784157a88ca2, 658261898130da620fc3d0fbb0523efb3366cb55, 2ba4caba423ed94d63006eb1d2227b0332ab7fcd, 9c55e41c73af5c4511070933b1bd25248521270c
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel4.15 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 7.05.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. Its callers only guarantee that the ICMPv6 header and target address are available, so the option area can still be non-linear. Parsing ns->opt[] in that case can access data past the linear buffer. Linearize request before option parsing and derive ns from the linear network header.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.