Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31531— ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在rtm_get_nexthop中分配固定大小的skb，可能导致大型多路径组查询失败并触发警告。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.16% · P5

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 430a049190de3c9e219f43084de9f1122da04570< 615517f3f8d53b0cf41507c7599971e17adfdfa5 affected
430a049190de3c9e219f43084de9f1122da04570< 40bd39e383a0478fd5c221f393df05fd9d70cfbc affected
430a049190de3c9e219f43084de9f1122da04570< 635038fe19db391117e66b46bdc2b6e447ac801d affected
430a049190de3c9e219f43084de9f1122da04570< 14cf0cd35361f4e94824bf8a42f72713d7702a73 affected
5.3 affected
< 5.3 unaffected
6.12.83≤ 6.12.* unaffected
6.18.24≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31531

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat: WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: <TASK> rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在rtm_get_nexthop中分配固定大小的skb，可能导致大型多路径组查询失败并触发警告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 430a049190de3c9e219f43084de9f1122da04570 ~ 615517f3f8d53b0cf41507c7599971e17adfdfa5 -
Linux Linux 5.3 -

II. Public POCs for CVE-2026-31531

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31531

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-23 · 3 CVEs total

CVE-2026-31533 9.8 CRITICAL net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
CVE-2026-31532 7.8 HIGH can: raw: fix ro->uniq use-after-free in raw_rcv()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31531

No comments yet

Leave a comment