GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31407 (GCVE-0-2026-31407)

Vulnerability from cvelistv5 – Published: 2026-04-06 07:38 – Updated: 2026-08-05 12:22
VLAI
Title
netfilter: conntrack: add missing netlink policy validations
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < e7b5766693477c52424cc6c79dd30a7a9c7db52c (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < 78bba9f73942aa7dca47d817d8cec0fb9b443b70 (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < be88a337bf07afb1ee173f1099294d1b7ab3fefe (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < c5e918390002edf0cff80a0e7ce1f86f16a9507c (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < 9174d28f3f15d8c4962f5980c0be167633880443 (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < 67c53c1978cef3c504237275e39c857e2f6af56e (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < 0fbae1e74493d5a160a70c51aeba035d8266ea7d (git)
Affected: a258860e01b80e8f554a4ab1a6c95e6042eb8b73 , < f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_netlink.c",
            "net/netfilter/nf_conntrack_proto_sctp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7b5766693477c52424cc6c79dd30a7a9c7db52c",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "78bba9f73942aa7dca47d817d8cec0fb9b443b70",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "be88a337bf07afb1ee173f1099294d1b7ab3fefe",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "c5e918390002edf0cff80a0e7ce1f86f16a9507c",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "9174d28f3f15d8c4962f5980c0be167633880443",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "67c53c1978cef3c504237275e39c857e2f6af56e",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "0fbae1e74493d5a160a70c51aeba035d8266ea7d",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            },
            {
              "lessThan": "f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05",
              "status": "affected",
              "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_netlink.c",
            "net/netfilter/nf_conntrack_proto_sctp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: add missing netlink policy validations\n\nHyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.\n\nThese attributes are used by the kernel without any validation.\nExtend the netlink policies accordingly.\n\nQuoting the reporter:\n  nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE\n  value directly to ct-\u003eproto.sctp.state without checking that it is\n  within the valid range. [..]\n\n  and: ... with exp-\u003edir = 100, the access at\n  ct-\u003emaster-\u003etuplehash[100] reads 5600 bytes past the start of a\n  320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by\n  UBSAN."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through NETLINK_NETFILTER ctnetlink messages sent by a local process. Later packet processing can trigger the bad state or expectation, but the attacker must first inject the malformed conntrack/expectation attributes locally.\nAC:L - The bug is triggered with crafted netlink attributes and does not require winning a race. The attacker can create the relevant conntrack/expectation state and matching traffic in a controlled network namespace.\nPR:L - nfnetlink requires CAP_NET_ADMIN in the socket\u0027s network namespace. Because this capability is reachable via user and network namespaces on affected deployments, this is low privilege rather than high privilege.\nUI:N - No victim action is required after the attacker can send the netlink request. The attacker can trigger the vulnerable paths directly.\nS:U - The impact remains within the kernel security authority. This is not a VM escape or cross-authority boundary bypass.\nC:H - The missing validation permits attacker-controlled out-of-bounds reads, including indexing beyond the master nf_conn tuplehash and SCTP state tables. This is not strictly bounded to a harmless few bytes, so high confidentiality impact is defensible.\nI:N - The investigated paths show out-of-bounds reads and invalid in-object state assignment, not an out-of-bounds write or control-flow overwrite. No direct integrity-impacting primitive was identified.\nA:H - The out-of-bounds reads are attacker-triggerable and were reported as UBSAN-confirmed slab out-of-bounds accesses. Such kernel faults can produce an oops or panic, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:16.533Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7b5766693477c52424cc6c79dd30a7a9c7db52c"
        },
        {
          "url": "https://git.kernel.org/stable/c/78bba9f73942aa7dca47d817d8cec0fb9b443b70"
        },
        {
          "url": "https://git.kernel.org/stable/c/be88a337bf07afb1ee173f1099294d1b7ab3fefe"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5e918390002edf0cff80a0e7ce1f86f16a9507c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9174d28f3f15d8c4962f5980c0be167633880443"
        },
        {
          "url": "https://git.kernel.org/stable/c/67c53c1978cef3c504237275e39c857e2f6af56e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fbae1e74493d5a160a70c51aeba035d8266ea7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05"
        }
      ],
      "title": "netfilter: conntrack: add missing netlink policy validations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31407",
    "datePublished": "2026-04-06T07:38:19.712Z",
    "dateReserved": "2026-03-09T15:48:24.086Z",
    "dateUpdated": "2026-08-05T12:22:16.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31407",
      "date": "2026-09-19",
      "epss": "0.00169",
      "percentile": "0.06663"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-01T14:38:27.000Z",
      "cve": "CVE-2026-31407",
      "id": "msrc_CVE-2026-31407",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: conntrack: add missing netlink policy validations",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31407.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_conntrack_netlink.c",
                  "net/netfilter/nf_conntrack_proto_sctp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e7b5766693477c52424cc6c79dd30a7a9c7db52c",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78bba9f73942aa7dca47d817d8cec0fb9b443b70",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be88a337bf07afb1ee173f1099294d1b7ab3fefe",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c5e918390002edf0cff80a0e7ce1f86f16a9507c",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9174d28f3f15d8c4962f5980c0be167633880443",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67c53c1978cef3c504237275e39c857e2f6af56e",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0fbae1e74493d5a160a70c51aeba035d8266ea7d",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05",
                    "status": "affected",
                    "version": "a258860e01b80e8f554a4ab1a6c95e6042eb8b73",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_conntrack_netlink.c",
                  "net/netfilter/nf_conntrack_proto_sctp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.27"
                  },
                  {
                    "lessThan": "2.6.27",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B3457033-D01A-43C8-836D-8E21A577B7A5",
                    "versionEndExcluding": "6.6.136",
                    "versionStartIncluding": "2.6.27",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8",
                    "versionEndExcluding": "6.12.83",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555",
                    "versionEndExcluding": "6.18.24",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581",
                    "versionEndExcluding": "6.19.10",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: add missing netlink policy validations\n\nHyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.\n\nThese attributes are used by the kernel without any validation.\nExtend the netlink policies accordingly.\n\nQuoting the reporter:\n  nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE\n  value directly to ct-\u003eproto.sctp.state without checking that it is\n  within the valid range. [..]\n\n  and: ... with exp-\u003edir = 100, the access at\n  ct-\u003emaster-\u003etuplehash[100] reads 5600 bytes past the start of a\n  320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by\n  UBSAN."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: conntrack: a\u00f1adir validaciones de pol\u00edticas netlink faltantes\n\nHyunwoo Kim informa de acceso fuera de l\u00edmites en sctp y ctnetlink.\n\nEstos atributos son utilizados por el kernel sin ninguna validaci\u00f3n.\nExtender las pol\u00edticas netlink en consecuencia.\n\nCitando al informante:\n  \u0027nlattr_to_sctp() asigna el valor CTA_PROTOINFO_SCTP_STATE proporcionado por el usuario\n  directamente a ct -\u003e proto.sctp.state sin comprobar que est\u00e9\n  dentro del rango v\u00e1lido. [..]\n\n  y: ... con exp -\u003e dir = 100, el acceso en\n  ct -\u003e master -\u003e tuplehash[100] lee 5600 bytes m\u00e1s all\u00e1 del inicio de un\n  objeto nf_conn de 320 bytes, causando una lectura fuera de l\u00edmites de slab confirmada por\n  UBSAN.\u0027"
          }
        ],
        "id": "CVE-2026-31407",
        "lastModified": "2026-07-24T22:10:00.140",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-06T08:16:38.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0fbae1e74493d5a160a70c51aeba035d8266ea7d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/67c53c1978cef3c504237275e39c857e2f6af56e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78bba9f73942aa7dca47d817d8cec0fb9b443b70"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9174d28f3f15d8c4962f5980c0be167633880443"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be88a337bf07afb1ee173f1099294d1b7ab3fefe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c5e918390002edf0cff80a0e7ce1f86f16a9507c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7b5766693477c52424cc6c79dd30a7a9c7db52c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T11:46:50+00:00",
      "cve": "CVE-2026-31407",
      "id": "CVE-2026-31407",
      "initial_release_date": "2026-04-06T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: conntrack: add missing netlink policy validations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31407.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:32:41Z",
      "cve": "CVE-2026-31407",
      "id": "CVE-2026-31407",
      "initial_release_date": "2026-04-06T23:25:07Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "274",
      "product_status:recommended": "317",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31407",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31407.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.