CVE-2026-31668

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31668", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.129Z", "datePublished": "2026-04-24T14:45:16.630Z", "dateUpdated": "2026-10-19T18:56:03.191Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:18.220Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable SRv6 lwtunnel input path is reachable by IPv6 packets forwarded through a configured SRv6 router, and those packets can populate the shared cache used by the other path. This is network-reachable in a reasonable SRv6 routing deployment.\nAC:L - The bug is deterministic cache reuse after one path populates the per-CPU dst_cache; an attacker can repeat traffic and influence ordering rather than win an uncontrolled race. The required differing routing contexts are normal SRv6 policy/VRF configurations.\nPR:N - Attacking an already configured SRv6 router does not require credentials or local privileges; unauthenticated network traffic can exercise the forwarding path. Route creation itself requires CAP_NET_ADMIN, but that is deployment setup rather than an attacker privilege requirement for the network attack.\nUI:N - No victim user action is required once the affected SRv6 route and policy rules are present. Packets alone drive the vulnerable lwtunnel paths.\nS:U - The impact remains within the Linux kernel/router routing authority and does not cross a hypervisor, IOMMU, or comparable security authority boundary. It is a routing policy bypass rather than a separate-scope escape.\nC:H - By reusing a dst computed in the wrong routing context, traffic can bypass VRF, rule, or blackhole isolation and reach protected networks or services. In a multi-tenant or segmented deployment this can expose data intended to be unreachable.\nI:H - The same policy bypass can allow unauthorized packets into protected routing domains or destinations, enabling modification or interaction with systems that routing policy was supposed to isolate. This is a broad network access-control bypass in the affected SRv6 path.\nA:H - Bypassing blackhole or VRF separation can allow repeated unwanted traffic to protected destinations or links that should have been dropped. In a reasonable router or DDoS-mitigation deployment this can defeat availability protections for the protected network."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6_iptunnel.c"], "versions": [{"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "1dec91d3b1cefb82635761b7812154af3ef46449", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "750569d6987a0ff46317a4b86eb3907e296287bf", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "57d0374d14fa667dec6952173b93e7e84486d5c9", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "84d458018b147176b259347103fccb7e93abd2b1", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "6305ad032b03d2ea4181b953a66e19a9a6ed053c", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "fb56de5d99218de49d5d43ef3a99e062ecd0f9a1", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a", "status": "affected", "versionType": "git"}, {"version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "c3812651b522fe8437ebb7063b75ddb95b571643", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6_iptunnel.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.169", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.135", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.169"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.135"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"}, {"url": "https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"}, {"url": "https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"}, {"url": "https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"}, {"url": "https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"}, {"url": "https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"}, {"url": "https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"}, {"url": "https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"}], "title": "seg6: separate dst_cache for input and output paths in seg6 lwtunnel", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31668", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:58.632847Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459 Incomplete Cleanup"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:56:03.191Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31668", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:11:58.632847Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459 Incomplete Cleanup"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:11:59.272Z"}}], "cna": {"title": "seg6: separate dst_cache for input and output paths in seg6 lwtunnel", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable SRv6 lwtunnel input path is reachable by IPv6 packets forwarded through a configured SRv6 router, and those packets can populate the shared cache used by the other path. This is network-reachable in a reasonable SRv6 routing deployment.\nAC:L - The bug is deterministic cache reuse after one path populates the per-CPU dst_cache; an attacker can repeat traffic and influence ordering rather than win an uncontrolled race. The required differing routing contexts are normal SRv6 policy/VRF configurations.\nPR:N - Attacking an already configured SRv6 router does not require credentials or local privileges; unauthenticated network traffic can exercise the forwarding path. Route creation itself requires CAP_NET_ADMIN, but that is deployment setup rather than an attacker privilege requirement for the network attack.\nUI:N - No victim user action is required once the affected SRv6 route and policy rules are present. Packets alone drive the vulnerable lwtunnel paths.\nS:U - The impact remains within the Linux kernel/router routing authority and does not cross a hypervisor, IOMMU, or comparable security authority boundary. It is a routing policy bypass rather than a separate-scope escape.\nC:H - By reusing a dst computed in the wrong routing context, traffic can bypass VRF, rule, or blackhole isolation and reach protected networks or services. In a multi-tenant or segmented deployment this can expose data intended to be unreachable.\nI:H - The same policy bypass can allow unauthorized packets into protected routing domains or destinations, enabling modification or interaction with systems that routing policy was supposed to isolate. This is a broad network access-control bypass in the affected SRv6 path.\nA:H - Bypassing blackhole or VRF separation can allow repeated unwanted traffic to protected destinations or links that should have been dropped. In a reasonable router or DDoS-mitigation deployment this can defeat availability protections for the protected network."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "1dec91d3b1cefb82635761b7812154af3ef46449", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "750569d6987a0ff46317a4b86eb3907e296287bf", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "57d0374d14fa667dec6952173b93e7e84486d5c9", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "84d458018b147176b259347103fccb7e93abd2b1", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "6305ad032b03d2ea4181b953a66e19a9a6ed053c", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "fb56de5d99218de49d5d43ef3a99e062ecd0f9a1", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a", "versionType": "git"}, {"status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "lessThan": "c3812651b522fe8437ebb7063b75ddb95b571643", "versionType": "git"}], "programFiles": ["net/ipv6/seg6_iptunnel.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"status": "unaffected", "version": "0", "lessThan": "4.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.169", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.135", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.82", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.23", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.13", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/seg6_iptunnel.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"}, {"url": "https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"}, {"url": "https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"}, {"url": "https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"}, {"url": "https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"}, {"url": "https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"}, {"url": "https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"}, {"url": "https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.169", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.135", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.82", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.23", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.13", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:18.220Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31668", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:56:03.191Z", "dateReserved": "2026-03-09T15:48:24.129Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:45:16.630Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/seg6_iptunnel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1dec91d3b1cefb82635761b7812154af3ef46449", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "750569d6987a0ff46317a4b86eb3907e296287bf", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "57d0374d14fa667dec6952173b93e7e84486d5c9", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "84d458018b147176b259347103fccb7e93abd2b1", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "6305ad032b03d2ea4181b953a66e19a9a6ed053c", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "fb56de5d99218de49d5d43ef3a99e062ecd0f9a1", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}, {"lessThan": "c3812651b522fe8437ebb7063b75ddb95b571643", "status": "affected", "version": "6c8702c60b88651072460f3f4026c7dfe2521d12", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/seg6_iptunnel.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.169", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.135", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.82", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0D3F33A-9B37-46EB-A8C3-97B2F00C65EB", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.10.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBEC0E5D-641C-4E98-A6D9-5799B10CE451", "versionEndExcluding": "6.1.169", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15C1A1B2-14EE-494C-AF3E-D5A7BA640B39", "versionEndExcluding": "6.6.135", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "02904CAE-71D2-45B3-9EC3-F6A9D18B6307", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*", "matchCriteriaId": "C201E405-86F2-4F96-984A-00A865219C86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nseg6: separar dst_cache para las rutas de entrada y salida en el lwtunnel seg6\n\nEl lwtunnel seg6 utiliza una \u00fanica dst_cache por ruta de encapsulaci\u00f3n, compartida entre seg6_input_core() y seg6_output_core(). Estas dos rutas pueden realizar la b\u00fasqueda de SID post-encapsulaci\u00f3n en diferentes contextos de enrutamiento (por ejemplo, reglas IP que coinciden en la interfaz de entrada, o separaci\u00f3n de tablas VRF). Cualquiera de las rutas que se ejecute primero rellena la cach\u00e9, y la otra la reutiliza ciegamente, omitiendo su propia b\u00fasqueda.\n\nEsto se soluciona dividiendo la cach\u00e9 en cache_input y cache_output, para que cada ruta mantenga su propia dst en cach\u00e9 de forma independiente."}], "id": "CVE-2026-31668", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31668", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:11:58.632847Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:46.533", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-459"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: seg6: separate dst_cache for input and output paths in seg6 lwtunnel", "id": "2461566", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461566"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's Segment Routing over IPv6 (SRv6) lightweight tunnel (seg6 lwtunnel). This component incorrectly shares a single destination cache between its input and output processing paths. This allows one path to reuse cached routing information populated by the other, bypassing its own independent routing context lookup. This can lead to unintended routing behavior or a bypass of network policy enforcement, potentially impacting network traffic integrity."], "name": "CVE-2026-31668", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31668\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31668\nhttps://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31668-50e7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,1dec91d3b1cefb82635761b7812154af3ef46449)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,750569d6987a0ff46317a4b86eb3907e296287bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,57d0374d14fa667dec6952173b93e7e84486d5c9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,84d458018b147176b259347103fccb7e93abd2b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,6305ad032b03d2ea4181b953a66e19a9a6ed053c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,fb56de5d99218de49d5d43ef3a99e062ecd0f9a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c8702c60b88651072460f3f4026c7dfe2521d12,c3812651b522fe8437ebb7063b75ddb95b571643)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.169,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.135,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.82,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-28T03:15:05.353301+00:00", "updated": "2026-10-23T08:15:17.505348+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}