Skip to main content

Linux Kernel CVE-2026-31663

| EUVDEUVD-2026-25556 HIGH
Premature Release of Resource During Expected Lifetime (CWE-826)
2026-04-24 Linux GHSA-v4m9-vrgr-8xm2
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local unprivileged code execution
  2. Delivery
    Ensure IPsec transport async crypto active
  3. Exploit
    Trigger network device teardown during resume
  4. Execution
    Race freed skb->dev in NF_HOOK
  5. Persist
    Corrupt kernel memory via use-after-free
  6. Impact
    Escalate privileges to root

Vulnerability Assessment

Weakness
CWE
CWE-826
Exploitation Conditions

Exploitation requires the target to be running IPsec/xfrm in transport mode with asynchronous crypto processing (the code path through xfrm_input_resume() and transport_finish NF_HOOK), plus a local foothold to execute code - the CVSS vector's PR:L indicates low-privilege authenticated local access is needed. The attacker must also induce or exploit concurrent network-device teardown to hit the freed skb->dev reference, making a timing race an essential prerequisite. Limiting factors: the flaw is not remotely reachable (AV:L), needs IPsec async-crypto to be configured and active (non-default on many systems), and depends on winning a narrow race window against device teardown, all of which sharply reduce realistic exploitability despite the HIGH base score.
Impact

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) rates this HIGH with full CIA impact, typical of a kernel memory-corruption primitive that can lead to privilege escalation. However, several signals temper real-world urgency: EPSS is 0.02% (4th percentile), there is no CISA KEV listing, and no public POC. The scenario is a use-after-free that requires winning a timing race against concurrent network-device teardown while IPsec async crypto processing is in flight - conditions that are hard to orchestrate reliably, which argues the actual attack complexity is higher than the AC:L in the provided vector suggests. This is a genuine, patch-worthy kernel bug for systems using IPsec, but it is not an internet-facing, remotely-triggerable emergency; prioritize it as part of routine kernel patching rather than an out-of-band response.
Exploit ScenarioDerived

A local attacker with the ability to run unprivileged code on a host using IPsec transport mode with async crypto arranges to tear down or reconfigure a network device precisely as an in-flight encrypted packet resumes processing, so that skb->dev is dereferenced after its net_device reference has been freed. Winning this race yields a use-after-free on a kernel object, which a skilled attacker could shape into memory corruption and local privilege escalation. No public POC is known, and success depends on reliably hitting the narrow timing window.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel - the EUVD data lists patched builds including 6.18.23 and 6.19.13, and per-branch fixes are available as the git.kernel.org commits (0f451b43c88b, 5002beda5cac, 1c428b038400, 4236c30b437b); on enterprise distributions install the corresponding backported kernel package and reboot, tracking status via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-31663. Where immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path by not using IPsec transport mode with asynchronous crypto offload on untrusted-adjacent hosts - for example disabling hardware/async crypto acceleration for xfrm or avoiding IPsec on the affected interfaces - accepting the trade-off of reduced throughput or loss of IPsec functionality; because exploitation requires local access, restricting local/interactive access and unprivileged code execution on the host also materially reduces exposure until the kernel is updated.

Affected VersionsENISA

Linux patch: 7.0
Linux patch: 6.18.23
Linux acf568ee859f098279eadf551612f103afdacb4e <5002beda5cac69d522dc54da0d5d463ed9c963d2
Linux 4.15
Linux 833760100588acfb267dac4d6a02ab9931237739
Linux patch: 0
Linux acf568ee859f098279eadf551612f103afdacb4e <1c428b03840094410c5fb6a5db30640486bbbfcb
Linux patch: 6.19.13
Linux 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f
Linux acf568ee859f098279eadf551612f103afdacb4e <0f451b43c88bf2b9c038b414be580efee42e031b
Linux e095ecaec6d94aa2156cceb98a85d409b51190f3

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected subsystem is xfrm, the Linux kernel framework implementing IPsec transformations (ESP/AH) for the network stack. When packets require decryption via asynchronous crypto offload, xfrm_input() defers processing and xfrm_input_resume() is invoked as a callback once crypto completes. The bug is a lifetime-management error (CWE-826, Premature Release of Resource During Expected Lifetime): the reference count on the ingress net_device is released too early, before the socket buffer (skb) and its embedded skb->dev pointer finish traversing the Netfilter NF_HOOK chain and the transport_finish continuation. Because NF_HOOK can consume the skb along NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn, the fix saves the device pointer and drops the reference only after the hook returns. CPE data identifies the affected component as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel itself.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local access and low privilege suffice (AV:L/PR:L), but triggering the use-after-free requires winning a race against device teardown, so AC:H; kernel memory corruption yields full C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 27, 2026 - 19:59 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 24, 2026 - 16:16 EUVD
CVE Published
Apr 24, 2026 - 14:45 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.

Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.

Executive ViewAI

Why It Matters

CVE-2026-31663 affects the Linux kernel's IPsec functionality and could enable privilege escalation on systems where this feature is enabled. The vulnerability currently poses negligible real-world risk-no known active exploits exist and exploitation probability is 0.0% (EPSS)-but the potential for system compromise on production infrastructure makes timely patching a business priority.

Business Impact: High
Compensating Controls

Apply vendor patch

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel runs on the vast majority of servers and appliances
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-826 – Premature Release of Resource During Expected Lifetime

View all
CVE-2026-49427 HIGH
8.8
CVE-2026-53322 HIGH
8.8
CVE-2023-1297 HIGH
7.5
CVE-2024-51727 HIGH
7.1
CVE-2024-58249 LOW
3.7
CVE-2025-24912 LOW
3.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31663 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/359468 REF https://access.redhat.com/errata/RHSA-2026:67471 REF https://access.redhat.com/errata/RHSA-2026:68531 REF https://access.redhat.com/errata/RHSA-2026:68532 REF https://access.redhat.com/errata/RHSA-2026:68570 REF https://access.redhat.com/security/cve/CVE-2026-31663 REF https://bugzilla.redhat.com/show_bug.cgi?id=2461462 REF https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b REF https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb REF https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e REF https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2 REF https://git.kernel.org/stable/c/94439cbe478b53f92223da9aae95fffb28623c3f REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy