Description
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: validate ND option lengths br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option span or use a too-short source LLADDR option payload. Validate option lengths against the remaining NS option area before advancing, and only read source LLADDR when the option is large enough for an Ethernet address.
References (10)
Core 10
Core References
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Scores
CVSS v3
5.5
EPSS
0.0013
EPSS Percentile
2.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (27)
linux/Kernel
4.15.0 - 5.10.253linux
linux/Kernel
5.11.0 - 5.15.203linux
linux/Kernel
5.16.0 - 6.1.168linux
linux/Kernel
6.13.0 - 6.18.22linux
linux/Kernel
6.19.0 - 6.19.12linux
linux/Kernel
6.2.0 - 6.6.134linux
linux/Kernel
6.7.0 - 6.12.81linux
Linux/Linux
< 4.15
Linux/Linux
4.15
Linux/Linux
5.10.253 - 5.10.*
... and 17 more
Published
May 01, 2026
Tracked Since
May 01, 2026