Single Line of Code Patches a 20-Year-Old Linux IPv6 Firewall Bug

A pair of eyes on a decades-old Linux kernel module has uncovered a security flaw that could let attackers slip malicious IPv6 packets past a firewall check — and the fix boils down to removing a single condition in the netfilter code.

The vulnerability, tracked as CVE-2026-31685, was published on April 25, 2026, and affects the ip6t_eui64 match module, a legacy iptables extension designed to validate the relationship between an IPv6 address and a device’s MAC address. The bug allowed crafted packets with an invalid MAC header to bypass a sanity check, potentially leading to memory access errors. While no CVSS severity score has been assigned yet, the flaw underscores how even niche, rarely used kernel paths can harbor dormant risks.

What Changed in the Kernel Patch

The vulnerable function, eui64_mt6(), attempts to derive a modified EUI-64 identifier from a packet’s Ethernet source address and compare it with the lower 64 bits of the IPv6 source address. The security problem wasn't in the EUI-64 math itself. It was in the guard condition that checked whether the MAC header was valid before reading it.

The old code would reject a packet with an invalid MAC header — but only when the packet was fragmented (par->fragoff != 0). For unfragmented packets, even if the MAC header was invalid, the code would proceed to call eth_hdr(skb) and access memory that might not contain a proper Ethernet header. That's a classic validate-before-access mistake.

The fix, which landed in the netfilter development tree and was quickly backported to stable kernels, simply removes the fragment-offset check. Now any packet with an invalid MAC header is immediately dropped, regardless of whether it's fragmented. The change touches only three lines in one file, yet it closes a logic error that dates back to Linux 2.6.12-rc2 — roughly June 2005.

Stable kernel branches receiving the patch include 6.12.83, 6.18.24, and 6.19.14, according to third-party trackers. However, enterprise distributions often backport fixes into their own kernel streams, so the safest approach is to verify the specific patch state rather than rely solely on a version number.

Who Should Care About This Fix

This vulnerability does not live in the Windows TCP/IP stack. If you run only Windows desktops and servers without Linux guests, your direct exposure is minimal. But it's rare for a modern enterprise to have no Linux anywhere.

The bug resides in a netfilter module that runs deep inside the Linux kernel's packet path. It can affect any system that combines IPv6 traffic handling with the ip6t_eui64 match, whether that system acts as a router, firewall, container host, or virtual appliance. Even if the module is never referenced in active firewall rules, its presence in the kernel means the vulnerable code is reachable — though exploitation would still require crafted IPv6 traffic and a loaded module.

Specific environments to check:
- Linux-based routers, gateways, and VPN concentrators
- Hyper-V or Azure Linux virtual machines acting as firewalls or proxies
- WSL2 instances on Windows, especially if custom networking or packet forwarding is configured
- Kubernetes nodes that rely on older iptables compatibility layers
- Network appliances, embedded devices, and homebrew firewall builds
- Any host where ip6tables rules use the -m eui64 match

For ordinary Linux desktop users and Windows users who run WSL only for development without raw IPv6 filtering, the practical risk is low. But power users who experiment with network namespaces, bridged networking, or custom kernel builds should pay attention.

How a Legacy IPv6 Feature Became a Security Liability

The ip6t_eui64 module exists because of IPv6's early design decisions. In the late 1990s and early 2000s, stateless address autoconfiguration (SLAAC) often derived a 64-bit interface identifier from a 48-bit MAC address by inserting ff:fe in the middle and flipping the universal/local bit. The idea was that a firewall could verify whether a packet's IPv6 source address genuinely matched the link-layer sender.

Reality moved on. Privacy extensions, stable private addresses, DHCPv6, and virtualized or overlay networks mean that an IPv6 interface identifier today rarely maps neatly to a visible Ethernet MAC. Yet the kernel module remained, unused by most but still buried in the codebase. It's exactly the kind of compatibility seam where bugs can live unnoticed for decades.

A Kernel Address Sanitizer (KASAN) report triggered the investigation. KASAN flagged a memory-safety issue when a non-fragmented packet with a bad MAC header was fed into the module. The resulting fix was minimal because the root cause was straightforward: two separate properties — fragmentation state and MAC header validity — were incorrectly chained together in a single guard condition.

What to Do Now: A Practical Checklist

Don't wait for a CVSS score before investigating. If you manage Linux systems that handle IPv6 traffic through netfilter, follow these steps:

1. Inventory Linux kernels that process IPv6. Include physical servers, VMs, containers, and appliances. Note which ones perform packet filtering or forwarding.
2. Check for the ip6t_eui64 module. Run lsmod | grep eui64 to see if it's loaded. Even if not loaded, it may be available; on many distributions it's built as a module that auto-loads when a rule references it.
3. Audit firewall rules. Execute ip6tables-save | grep eui64 to find any rules using the match. If you find none and the module isn't loaded, risk is very low.
4. Apply kernel updates. Track your Linux vendor’s advisory. For Debian, Ubuntu, RHEL, SUSE, and others, a security update will ship the backported fix.
5. Update WSL kernels if you use WSL2 for networking-heavy workloads. The standard WSL kernel from Microsoft may not yet include the patch; check the WSL kernel release notes or update via Windows Update.
6. Reboot and verify. Kernel changes take effect only after a restart (unless live-patching is used). Retest any specialized IPv6 firewall policies after the update.

For enterprises, prioritize internet-facing or partner-facing nodes. Internal application servers with no IPv6 forwarding and no unusual firewall rules can follow the normal patch cycle.

The Wider Lesson for Firewall Security

This bug is not just a one-off fix. It’s a reminder that packet parsers operating at kernel privilege are a high-value target. Netfilter has seen multiple security fixes in recent years — use-after-free bugs, out-of-bounds reads, and reference-count errors — precisely because it must make fast, complex decisions on attacker-controlled data.

The move from legacy iptables to nftables is underway, but compatibility layers ensure that modules like ip6t_eui64 remain available for years. Administrators should audit rarely used matches and consider retiring those that encode assumptions no longer valid (like MAC-derived IPv6 addresses).

Three design rules stand out: validate before you derefence; never tie a security check to an unrelated protocol detail like fragment offset; and treat all packet metadata as untrusted until proven otherwise.

What’s Next

The immediate item to watch is NVD enrichment. The CVE record currently lacks a CVSS vector, CWE classification, and affected software listing. Once those arrive, vulnerability scanners will converge on a more consistent rating. But if your internal assessment shows you run the vulnerable code path, don’t delay.

Vendor advisories will be the authoritative signal. Distributions like Red Hat, SUSE, Ubuntu, and Debian may release fixes under their own package versions, while cloud platforms like Azure will update their Linux images. Microsoft may also provide guidance if the WSL kernel is affected.

CVE-2026-31685 will likely not be a landmark vulnerability, but it’s the kind of disciplined fix that separates mature infrastructure operations from reactive ones. The right response isn’t panic; it’s inventory, patch, and verify.