CVE-2026-31407 Details
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.
A vulnerability in the Linux kernel's netfilter component allows for out-of-bounds access in the Stream Control Transmission Protocol (SCTP) handling within the connection tracking netlink interface. This issue arises because user-supplied data is not properly validated before being used by the kernel, leading to potential memory access violations. Specifically, the problem occurs when the SCTP state attribute is assigned directly to a connection tracking object without range checks. As a result, an attacker could manipulate the direction of an expectation to read beyond the allocated memory of a connection tracking object, causing a slab-out-of-bounds read, which has been confirmed by Undefined Behavior Sanitizer (UBSAN).
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the kernel can be found in the official Linux kernel documentation or through the package management system of the respective Linux distribution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.27, < 6.6.136 >= 6.7, < 6.12.83 >= 6.13, < 6.18.24 >= 6.19, < 6.19.10 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 20, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 22, 2026 | CVE Modified | kernel.org |
| Apr 6, 2026 | New CVE Received | kernel.org |