CVE-2026-31664

MEDIUM EPSS 1.8%
Published Apr 24, 20262mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Apr 24, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire. The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents. Add the missing memset_after() call, matching build_expire().

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
1.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 17

VendorProductVersionRange
linuxlinux_kernel*≥2.6.12.1  –  <6.1.169
linuxlinux_kernel*≥6.2  –  <6.6.135
linuxlinux_kernel*≥6.7  –  <6.12.82
linuxlinux_kernel*≥6.13  –  <6.18.23
linuxlinux_kernel*≥6.19  –  <6.19.13
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel2.6.12any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any
linuxlinux_kernel7.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a5127501c8d30b5728791b1e340284ca5c9cc4bd
  • git.kernel.org https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e6f4ffe8596947a595c9544e73a73adcb0568b88
  • git.kernel.org https://git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37
    Patch