Findings

CVE-2026-31415

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : I believe I found a locally…

Published Apr 13, 2026 · updated Oct 15, 2026 · linux linux kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the kernel via (local DoS). The core issue is a mismatch between: - a 16-bit length accumulator ( , type ) and - a pointer to the *last* provided destination-options header ( ) when multiple control messages (cmsgs) are provided. - : - is (wrap possible). (lines 291-307, especially 298) - : - Accepts repeated and accumulates into without rejecting duplicates. (lines 909-933) - : - Uses to compute header sizes/headroom decisions. (lines 1448-1466, especially 1463-1465) - : - Calls if is non-zero. (lines 1930-1934) - / : - Push size comes from (based on the pointed-to header). (lines 1179-1185 and 1206-1211) 1. is a 16-bit accumulator: - defines . 2. accepts *repeated* cmsgs and increments each time: - In , for : - It computes - It checks using . (line 922) - Then it does: - (line 927) - (line 928) There is no duplicate rejection here (unlike the legacy path which rejects duplicates at ). If enough large cmsgs are provided, wraps while still points to a large (2048-byte) destination-options header. In the attached PoC ( ): - 32 cmsgs with => - 1 cmsg with => - Total increment: , so - The last cmsg is 2048 bytes, so points to a 2048-byte header. 3. The transmit path sizes headers using the wrapped : - In : - With wrapped , /headroom decisions underestimate what will be pushed later. 4. When building the final skb, the actual push length comes from and is not limited by wrapped : - In : - - In , pushes via . - In , does: - - With insufficient headroom, underflows and triggers -> : - ( calls ) - ( ends in ) - The cmsg path requires in the target netns user namespace ( ). - Root (or any task with ) can trigger this without user namespaces. - An unprivileged user can trigger this if unprivileged user namespaces are enabled and it c