{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31668", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.129Z", "datePublished": "2026-04-24T14:45:16.630Z", "dateUpdated": "2026-08-05T12:24:18.220Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:18.220Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable SRv6 lwtunnel input path is reachable by IPv6 packets forwarded through a configured SRv6 router, and those packets can populate the shared cache used by the other path. This is network-reachable in a reasonable SRv6 routing deployment.\nAC:L - The bug is deterministic cache reuse after one path populates the per-CPU dst_cache; an attacker can repeat traffic and influence ordering rather than win an uncontrolled race. The required differing routing contexts are normal SRv6 policy/VRF configurations.\nPR:N - Attacking an already configured SRv6 router does not require credentials or local privileges; unauthenticated network traffic can exercise the forwarding path. Route creation itself requires CAP_NET_ADMIN, but that is deployment setup rather than an attacker privilege requirement for the network attack.\nUI:N - No victim user action is required once the affected SRv6 route and policy rules are present. Packets alone drive the vulnerable lwtunnel paths.\nS:U - The impact remains within the Linux kernel/router routing authority and does not cross a hypervisor, IOMMU, or comparable security authority boundary. It is a routing policy bypass rather than a separate-scope escape.\nC:H - By reusing a dst computed in the wrong routing context, traffic can bypass VRF, rule, or blackhole isolation and reach protected networks or services. In a multi-tenant or segmented deployment this can expose data intended to be unreachable.\nI:H - The same policy bypass can allow unauthorized packets into protected routing domains or destinations, enabling modification or interaction with systems that routing policy was supposed to isolate. This is a broad network access-control bypass in the affected SRv6 path.\nA:H - Bypassing blackhole or VRF separation can allow repeated unwanted traffic to protected destinations or links that should have been dropped. In a reasonable router or DDoS-mitigation deployment this can defeat availability protections for the protected network." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/seg6_iptunnel.c" ], "versions": [ { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "1dec91d3b1cefb82635761b7812154af3ef46449", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "750569d6987a0ff46317a4b86eb3907e296287bf", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "57d0374d14fa667dec6952173b93e7e84486d5c9", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "84d458018b147176b259347103fccb7e93abd2b1", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "6305ad032b03d2ea4181b953a66e19a9a6ed053c", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "fb56de5d99218de49d5d43ef3a99e062ecd0f9a1", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a", "status": "affected", "versionType": "git" }, { "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "c3812651b522fe8437ebb7063b75ddb95b571643", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/seg6_iptunnel.c" ], "versions": [ { "version": "4.10", "status": "affected" }, { "version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.169", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.135", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.169" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.82" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.19.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449" }, { "url": "https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf" }, { "url": "https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9" }, { "url": "https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1" }, { "url": "https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c" }, { "url": "https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1" }, { "url": "https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a" }, { "url": "https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643" } ], "title": "seg6: separate dst_cache for input and output paths in seg6 lwtunnel", "x_generator": { "engine": "bippy-1.2.0" } } } }