CVE-2026-31685

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because the eui64_mt6() function, which processes IPv6 packets, does not properly validate the MAC header for all packets. Specifically, packets with a zero fragment offset could bypass an existing guard, allowing the system to attempt to access an invalid MAC header. A remote attacker could exploit this by sending specially crafted IPv6 packets, potentially causing a system crash and leading to a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering it requires a non-standard network filtering configuration that explicitly enables IPv6 EUI-64 matching. In default installations, the affected netfilter extension is not active or loaded, significantly restricting the attack surface. While an attacker on the local network could theoretically cause a kernel crash or system denial of service by sending malformed IPv6 traffic, the issue only presents a risk on systems actively inspecting source MAC addresses through this specific match target.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.