{"id":"CVE-2026-31752","title":"bridge: br_nd_send: validate ND option lengths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyon…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 82a42eceec7c6bdb0e0da94c0542a173b7ea57f2","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 259466f76f5a2148aff11134e68f4b4c6d52725b","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < c49b9256bbacb6a135654aebd12e4c0e87166b7c","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 837392a38445729c22e03d3abcf33f07763efd85","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < e71303a9190496136e240c4f2872b7b0b16027a7","Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 850837965af15707fd3142c1cf3c5bfaf022299b","Linux 4.15"],"published":"2026-05-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:48:13.735Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31752","references":[{"url":"https://git.kernel.org/stable/c/82a42eceec7c6bdb0e0da94c0542a173b7ea57f2"},{"url":"https://git.kernel.org/stable/c/259466f76f5a2148aff11134e68f4b4c6d52725b"},{"url":"https://git.kernel.org/stable/c/ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a"},{"url":"https://git.kernel.org/stable/c/e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa"},{"url":"https://git.kernel.org/stable/c/c49b9256bbacb6a135654aebd12e4c0e87166b7c"},{"url":"https://git.kernel.org/stable/c/837392a38445729c22e03d3abcf33f07763efd85"},{"url":"https://git.kernel.org/stable/c/e71303a9190496136e240c4f2872b7b0b16027a7"},{"url":"https://git.kernel.org/stable/c/850837965af15707fd3142c1cf3c5bfaf022299b"}],"tags":["cve.org"],"epss":0.00171,"epssPercentile":0.05624,"ingestedAt":"2026-09-08T15:33:26.989Z","slug":"CVE-2026-31752","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.\n\n## Affected\n\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 82a42eceec7c6bdb0e0da94c0542a173b7ea57f2`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 259466f76f5a2148aff11134e68f4b4c6d52725b`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < c49b9256bbacb6a135654aebd12e4c0e87166b7c`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 837392a38445729c22e03d3abcf33f07763efd85`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < e71303a9190496136e240c4f2872b7b0b16027a7`\n- `Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 850837965af15707fd3142c1cf3c5bfaf022299b`\n- `Linux 4.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}