Skip to main content

Linux Kernel CVE-2026-31663

| EUVDEUVD-2026-25556 HIGH
Premature Release of Resource During Expected Lifetime (CWE-826)
2026-04-24 Linux GHSA-v4m9-vrgr-8xm2
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local access and low privilege suffice (AV:L/PR:L), but triggering the use-after-free requires winning a race against device teardown, so AC:H; kernel memory corruption yields full C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:26 vuln.today
Patch released
Apr 27, 2026 - 19:59 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25556
CVE Published
Apr 24, 2026 - 14:45 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.

Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.

AnalysisAI

Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.

Technical ContextAI

The affected subsystem is xfrm, the Linux kernel framework implementing IPsec transformations (ESP/AH) for the network stack. When packets require decryption via asynchronous crypto offload, xfrm_input() defers processing and xfrm_input_resume() is invoked as a callback once crypto completes. The bug is a lifetime-management error (CWE-826, Premature Release of Resource During Expected Lifetime): the reference count on the ingress net_device is released too early, before the socket buffer (skb) and its embedded skb->dev pointer finish traversing the Netfilter NF_HOOK chain and the transport_finish continuation. Because NF_HOOK can consume the skb along NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn, the fix saves the device pointer and drops the reference only after the hook returns. CPE data identifies the affected component as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel itself.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel - the EUVD data lists patched builds including 6.18.23 and 6.19.13, and per-branch fixes are available as the git.kernel.org commits (0f451b43c88b, 5002beda5cac, 1c428b038400, 4236c30b437b); on enterprise distributions install the corresponding backported kernel package and reboot, tracking status via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-31663. Where immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path by not using IPsec transport mode with asynchronous crypto offload on untrusted-adjacent hosts - for example disabling hardware/async crypto acceleration for xfrm or avoiding IPsec on the affected interfaces - accepting the trade-off of reduced throughput or loss of IPsec functionality; because exploitation requires local access, restricting local/interactive access and unprivileged code execution on the host also materially reduces exposure until the kernel is updated.

Same weakness CWE-826 – Premature Release of Resource During Expected Lifetime

View all
CVE-2026-49427 HIGH
8.8
CVE-2026-53322 HIGH
8.8
CVE-2023-1297 HIGH
7.5
CVE-2024-51727 HIGH
7.1
CVE-2024-58249 LOW
3.7
CVE-2025-24912 LOW
3.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31663 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy