{"id":"CVE-2026-31674","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the boun…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the boun…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.12.1, < 5.10.253","linux_kernel >= 5.11, < 5.15.203","linux_kernel >= 5.16, < 6.1.168","linux_kernel >= 6.2, < 6.6.131","linux_kernel >= 6.7, < 6.12.80","linux_kernel >= 6.13, < 6.18.21","linux_kernel >= 6.19, < 6.19.11","linux_kernel = 2.6.12","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.11"],"published":"2026-04-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:16.470","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31674","references":[{"url":"https://git.kernel.org/stable/c/13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29ea965a1353bc8303877422f79c8211e9ba9c55","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d3f027327c2fa265f7f85ead41294792c3296ed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a28ebf6f99de270d6338ccdc3b49f3e818f99b7b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af9b7e2b765966457f4ec23be5bd34a141f89574","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8795fde1f78669a87c87ac29fceab2f104daa8c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ded71f5684df16fa645cca5bf4fe6b0cd8a46119","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00167,"epssPercentile":0.05936,"ingestedAt":"2026-09-08T15:33:26.989Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:12:07.905080Z"},"slug":"CVE-2026-31674","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value.\n\n## Affected\n\n- `linux_kernel >= 2.6.12.1, < 5.10.253`\n- `linux_kernel >= 5.11, < 5.15.203`\n- `linux_kernel >= 5.16, < 6.1.168`\n- `linux_kernel >= 6.2, < 6.6.131`\n- `linux_kernel >= 6.7, < 6.12.80`\n- `linux_kernel >= 6.13, < 6.18.21`\n- `linux_kernel >= 6.19, < 6.19.11`\n- `linux_kernel = 2.6.12`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.11`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}