CVE-2026-31668
Linux Kernel vulnerability
- Published24 Apr 2026
Description
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
Remediation
- https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a
- https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449
- https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9
- https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c
- https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf
- https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1
References
- https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a
- https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449
- https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9
- https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c
- https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf
- https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1
- https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643
- https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1
Frequently asked
Is CVE-2026-31668 being actively exploited?
CVE-2026-31668 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.79%.
How severe is CVE-2026-31668?
CVE-2026-31668 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.79% probability of exploitation.
Which products are affected by CVE-2026-31668?
Affected products include Linux Kernel.
How do I fix CVE-2026-31668?
Upgrade affected software to a fixed version, for example Linux Kernel 5.10.253 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2026-31668 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.