{"id":"DEBIAN-CVE-2026-31415","details":"In the Linux kernel, the following vulnerability has been resolved:  ipv6: avoid overflows in ip6_datagram_send_ctl()  Yiming Qian reported : \u003cquote\u003e  I believe I found a locally triggerable kernel bug in the IPv6 sendmsg  ancillary-data path that can panic the kernel via `skb_under_panic()`  (local DoS).   The core issue is a mismatch between:   - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type  `__u16`) and  - a pointer to the *last* provided destination-options header (`opt-\u003edst1opt`)   when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.   - `include/net/ipv6.h`:    - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).  (lines 291-307, especially 298)  - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:    - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`  without rejecting duplicates. (lines 909-933)  - `net/ipv6/ip6_output.c:__ip6_append_data()`:    - Uses `opt-\u003eopt_flen + opt-\u003eopt_nflen` to compute header  sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)  - `net/ipv6/ip6_output.c:__ip6_make_skb()`:    - Calls `ipv6_push_frag_opts()` if `opt-\u003eopt_flen` is non-zero.  (lines 1930-1934)  - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:    - Push size comes from `ipv6_optlen(opt-\u003edst1opt)` (based on the  pointed-to header). (lines 1179-1185 and 1206-1211)   1. `opt_flen` is a 16-bit accumulator:   - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.   2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs  and increments `opt_flen` each time:   - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:    - It computes `len = ((hdr-\u003ehdrlen + 1) \u003c\u003c 3);`    - It checks `CAP_NET_RAW` using `ns_capable(net-\u003euser_ns,  CAP_NET_RAW)`. (line 922)    - Then it does:      - `opt-\u003eopt_flen += len;` (line 927)      - `opt-\u003edst1opt = hdr;` (line 928)   There is no duplicate rejection here (unlike the legacy  `IPV6_2292DSTOPTS` path which rejects duplicates at  `net/ipv6/datagram.c:901-904`).   If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps  while `dst1opt` still points to a large (2048-byte)  destination-options header.   In the attached PoC (`poc.c`):   - 32 cmsgs with `hdrlen=255` =\u003e `len = (255+1)*8 = 2048`  - 1 cmsg with `hdrlen=0` =\u003e `len = 8`  - Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8`  - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.   3. The transmit path sizes headers using the wrapped `opt_flen`:  - In `net/ipv6/ip6_output.c:1463-1465`:   - `headersize = sizeof(struct ipv6hdr) + (opt ? opt-\u003eopt_flen +  opt-\u003eopt_nflen : 0) + ...;`   With wrapped `opt_flen`, `headersize`/headroom decisions underestimate  what will be pushed later.   4. When building the final skb, the actual push length comes from  `dst1opt` and is not limited by wrapped `opt_flen`:   - In `net/ipv6/ip6_output.c:1930-1934`:    - `if (opt-\u003eopt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);`  - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes  `dst1opt` via `ipv6_push_exthdr()`.  - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:    - `skb_push(skb, ipv6_optlen(opt));`    - `memcpy(h, opt, ipv6_optlen(opt));`   With insufficient headroom, `skb_push()` underflows and triggers  `skb_under_panic()` -\u003e `BUG()`:   - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)  - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)   - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target  netns user namespace (`ns_capable(net-\u003euser_ns, CAP_NET_RAW)`).  - Root (or any task with `CAP_NET_RAW`) can trigger this without user  namespaces.  - An unprivileged `uid=1000` user can trigger this if unprivileged  user namespaces are enabled and it can create a userns+netns to obtain  namespaced `CAP_NET_RAW` (the attached PoC does this).   - Local denial of service: kernel BUG/panic (system crash).  - ---truncated---","modified":"2026-09-29T13:03:48.792617174Z","published":"2026-04-13T14:16:10.707Z","upstream":["CVE-2026-31415"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-31415"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.170-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31415.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31415.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.12-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31415.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}