Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31674— netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ip6t_rt中addrnr参数未验证上限，可能导致越界访问rtinfo->addrs数组。

CVSS 7.1 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< af9b7e2b765966457f4ec23be5bd34a141f89574 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 29ea965a1353bc8303877422f79c8211e9ba9c55 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ded71f5684df16fa645cca5bf4fe6b0cd8a46119 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d8795fde1f78669a87c87ac29fceab2f104daa8c affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a28ebf6f99de270d6338ccdc3b49f3e818f99b7b affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 9d3f027327c2fa265f7f85ead41294792c3296ed affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31674

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Validate addrnr during rule installation so malformed rules are rejected before the match logic can use an out-of-range value.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ip6t_rt中addrnr参数未验证上限，可能导致越界访问rtinfo->addrs数组。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-31674

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31674

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-25 · 13 CVEs total

CVE-2026-31685 9.4 CRITICAL netfilter: ip6t_eui64: reject invalid MAC header for all packets
CVE-2026-31682 9.1 CRITICAL bridge: br_nd_send: linearize skb before parsing ND options
CVE-2026-31683 7.8 HIGH batman-adv: avoid OGM aggregation when skb tailroom is insufficient
CVE-2026-31680 7.8 HIGH net: ipv6: flowlabel: defer exclusive option free until RCU teardown
CVE-2026-31678 7.8 HIGH openvswitch: defer tunnel netdev_put to RCU release
CVE-2026-31675 7.8 HIGH net/sched: sch_netem: fix out-of-bounds access in packet corruption
CVE-2026-31673 7.8 HIGH af_unix: read UNIX_DIAG_VFS data under unix_state_lock
CVE-2026-31676 7.5 HIGH rxrpc: only handle RESPONSE during service challenge
CVE-2026-31679 7.1 HIGH openvswitch: validate MPLS set/set_masked payload length
CVE-2026-31684 net: sched: act_csum: validate nested VLAN headers
CVE-2026-31681 netfilter: xt_multiport: validate range encoding in checkentry
CVE-2026-31677 crypto: af_alg - limit RX SG extraction by receive buffer budget

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31674

No comments yet

Leave a comment