CVE-2026-31668

CRITICAL EPSS 35.4%
Published Apr 24, 20262mo ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Apr 24, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
35.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 15

VendorProductVersionRange
linuxlinux_kernel*≥4.10.1  –  <5.10.253
linuxlinux_kernel*≥5.11  –  <5.15.203
linuxlinux_kernel*≥5.16  –  <6.1.169
linuxlinux_kernel*≥6.2  –  <6.6.135
linuxlinux_kernel*≥6.7  –  <6.12.82
linuxlinux_kernel*≥6.13  –  <6.18.23
linuxlinux_kernel*≥6.19  –  <6.19.13
linuxlinux_kernel4.10any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1
    Patch