Skip to main content

Linux Kernel CVE-2026-31518

| EUVDEUVD-2026-24902 MEDIUM
Memory Leak (CWE-401)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-f37v-5r8j-33m9
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 17:37 vuln.today
CVSS changed
Apr 28, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 17:25 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24902
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

esp: fix skb leak with espintcp and async crypto

When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us.

With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.

AnalysisAI

Memory leak in Linux kernel ESP-over-TCP implementation with asynchronous cryptography causes denial of service via socket queue exhaustion when crypto operations complete asynchronously. Authenticated local attackers can trigger the vulnerability by filling the TX queue for espintcp connections while using async crypto algorithms, preventing proper cleanup of socket buffers and gradually consuming system memory until services become unavailable. EPSS score of 0.02% indicates low real-world exploitation probability despite moderate CVSS severity.

Technical ContextAI

The vulnerability exists in the Linux kernel's IPsec ESP (Encapsulating Security Payload) implementation when operating in TCP mode (espintcp), specifically in the interaction between the esp_output_tail_tcp function and asynchronous cryptographic operations. When synchronous crypto is used, the kernel's common xfrm output code automatically drops packets when the TX queue is full and an error is returned. However, when asynchronous crypto is enabled via esp_output_done callback, this automatic cleanup does not occur, leaving socket buffers (skb structures) unfreed when esp_output_tail_tcp returns an error due to queue saturation. This is a classic resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in kernel networking code. The vulnerability affects all Linux kernel versions from 5.6 through 7.0-rc3 that include the affected espintcp code paths, as indicated by the CPE strings covering all versions without explicit version constraints.

RemediationAI

Patch to the latest stable kernel version for your branch: Linux 5.10.253 or later for 5.10.x series, 5.15.203 or later for 5.15.x, 6.1.168 or later for 6.1.x, 6.6.131 or later for 6.6.x, 6.12.80 or later for 6.12.x, 6.18.21 or later for 6.18.x, 6.19.11 or later for 6.19.x, or 7.0 final release or later. The fix is available via git.kernel.org stable commits 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 and related backports. As a compensating control if immediate patching is not possible, disable asynchronous cryptography for espintcp by using synchronous crypto algorithms only (configuration-dependent) or avoid deploying IPsec-over-TCP in high-throughput scenarios where queue saturation could occur. These mitigations do not eliminate the vulnerability but reduce trigger likelihood. Kernel patching is the primary recommended fix with no known side effects.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31518 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy