CVE-2026-31668

CriticalCVSS 9.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.

Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-459

Affected software

VendorProductVersions
LinuxLinux>= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 1dec91d3b1cefb82635761b7812154af3ef46449; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 750569d6987a0ff46317a4b86eb3907e296287bf; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 57d0374d14fa667dec6952173b93e7e84486d5c9; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 84d458018b147176b259347103fccb7e93abd2b1; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 6305ad032b03d2ea4181b953a66e19a9a6ed053c; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < fb56de5d99218de49d5d43ef3a99e062ecd0f9a1; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < 17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a; >= 6c8702c60b88651072460f3f4026c7dfe2521d12, < c3812651b522fe8437ebb7063b75ddb95b571643
LinuxLinux4.10

References

Timeline

Published
Apr 24, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-316699.8In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash CVE-2026-31678.8A security flaw has been discovered in Tenda F453 1.0.0.3. The impacted element is the function formWebTypeLibrary of the file /goform/webtyCVE-2026-316705.5In the Linux kernel, the following vulnerability has been resolved: net: rfkill: prevent unlimited numbers of rfkill events from being creaCVE-2026-316715.5In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is CVE-2026-316725.5In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00usb: fix devres lifetime USB drivers bind to USB interfaceCVE-2026-316737.8In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diagCVE-2026-316747.1In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rCVE-2026-316757.8In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption InCVE-2026-316767.5In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPCVE-2026-316775.5In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make CVE-2026-316787.8In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_CVE-2026-316797.1In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set(
CVE-2026-31668: Critical severity, CVSS 9.8 | Vulnix