Loading story…
A flaw in the Linux kernel's netfilter ip6t_eui64 component, tracked as CVE-2026-31685, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in eui64_mt6(), where the code could still call eth_hdr(skb) when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing.
The issue affected code dating back to Linux kernel 2.6.12 and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including 6.12.83, 6.18.24, 6.19.14, and 7.0, while Red Hat shipped patches through security errata for multiple RHEL 7, 8, 9, and 10 product variants. Red Hat rated the flaw Moderate with a CVSS 7.1 for its products, although cve.org listed a 9.4 score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat released security errata fixing CVE-2026-31685 for RHEL 10 (RHSA-2026:21557), RHEL 9 (RHSA-2026:21556), and RHEL 8 including kernel and kernel-rt packages (RHSA-2026:21706 and RHSA-2026:21745).
The Linux kernel CVE team published CVE-2026-31685, explaining that ip6t_eui64 must reject invalid MAC headers for all packets and documenting fixes across multiple stable branches.
Red Hat's record for CVE-2026-31685 was made public, describing a Linux kernel netfilter flaw that could let crafted IPv6 packets trigger a denial-of-service condition.
Red Hat issued RHSA-2026:41236 to fix CVE-2026-31685 in Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt packages.
Red Hat released RHSA-2026:26535 to address CVE-2026-31685 in Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and 8.4 Extended Update Support Long-Life Add-On.
Red Hat shipped RHSA-2026:25533 to fix CVE-2026-31685 for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On.
Red Hat released RHSA-2026:25095 to remediate CVE-2026-31685 in Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat issued RHSA-2026:24343 to address CVE-2026-31685 in Red Hat Enterprise Linux 10.0 Extended Update Support.
The flaw was fixed upstream in Linux kernel releases 6.12.83, 6.18.24, 6.19.14, and 7.0 by removing the condition that only rejected invalid MAC headers when par->fragoff was nonzero.
The vulnerable behavior in netfilter's ip6t_eui64 component was introduced in Linux kernel 2.6.12, allowing eui64_mt6() to reach eth_hdr(skb) for some packets with invalid MAC headers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026