# seg6: separate dst_cache for input and output paths in seg6 lwtunnel

CVE record · `CVE-2026-31668`

- **Identifiers:** `CVE-2026-31668`
- **State:** Confirmed
- **Severity:** CVSS 9.8 Critical
- **Critical:** Yes: CVSS 9+
- **CNA:** Linux
- **Weakness (CWE):** [CWE-459](https://cwe.mitre.org/data/definitions/459.html)
- **Tags:** [CWE-459](https://agentprime.io/advisories/tag/cwe-459.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 24 Apr 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 24 Apr 2026, 14:45 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 9.8: 9.0 or more.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 1dec91d3b1cefb82635761b7812154af3ef46449` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 750569d6987a0ff46317a4b86eb3907e296287bf` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 57d0374d14fa667dec6952173b93e7e84486d5c9` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 84d458018b147176b259347103fccb7e93abd2b1` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 6305ad032b03d2ea4181b953a66e19a9a6ed053c` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before fb56de5d99218de49d5d43ef3a99e062ecd0f9a1` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before 17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a` (git)
  - affected: `6c8702c60b88651072460f3f4026c7dfe2521d12 to before c3812651b522fe8437ebb7063b75ddb95b571643` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.10`
  - unaffected: `before 4.10` (semver)
  - unaffected: `5.10.253 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.203 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.169 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.135 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.82 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.23 to 6.18.*, inclusive` (semver)
  - unaffected: `6.19.13 to 6.19.*, inclusive` (semver)
  - unaffected: `7.0 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0044, the 38th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 24 Apr 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-31668](https://www.cve.org/CVERecord?id=CVE-2026-31668)
- [NVD: CVE-2026-31668](https://nvd.nist.gov/vuln/detail/CVE-2026-31668)

### References from the CNA

- <https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449>
- <https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf>
- <https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9>
- <https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1>
- <https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c>
- <https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1>
- <https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a>
- <https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-31668>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-31668/>. Everything for agents: <https://agentprime.io/llms.txt>.