CVE-2026-31752None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: validate ND option lengths br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyon…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
0.1% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
bridge: br_nd_send: validate ND option lengths
br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 82a42eceec7c6bdb0e0da94c0542a173b7ea57f2Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 259466f76f5a2148aff11134e68f4b4c6d52725bLinux >= ed842faeb2bd49256f00485402f3113205f91d30 < ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43aLinux >= ed842faeb2bd49256f00485402f3113205f91d30 < e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aaLinux >= ed842faeb2bd49256f00485402f3113205f91d30 < c49b9256bbacb6a135654aebd12e4c0e87166b7cLinux >= ed842faeb2bd49256f00485402f3113205f91d30 < 837392a38445729c22e03d3abcf33f07763efd85Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < e71303a9190496136e240c4f2872b7b0b16027a7Linux >= ed842faeb2bd49256f00485402f3113205f91d30 < 850837965af15707fd3142c1cf3c5bfaf022299bLinux 4.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93285NoneIn the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs_gc_kthread in f2fs_sb_info Instead of allocating f2fs_gc_kthread dynamically, embed it in f2fs_sb_info
CVE-2026-93286NoneIn the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast path without checking for NULL
CVE-2026-93781NoneIn the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsi_eh_lock_door() scsi_eh_lock_door() is called from scsi_restart_operations() while the host is still in the SHOST_REC…
CVE-2026-93783NoneIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame rfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences hdr->addr and hdr->ctrl without v…
CVE-2026-93784NoneIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211_wext_siwgenie…
CVE-2026-93785NoneIn the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key->datalen, which is limited to U16_MAX