Skip to main content

Linux Kernel CVE-2026-31664

| EUVDEUVD-2026-25557 MEDIUM
2026-04-24 Linux GHSA-5fvv-6wpc-9mr7
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege user can read kernel heap via netlink; pure confidentiality impact with no integrity or availability effect, contradicting the provided C:N/A:H vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:26 vuln.today
CVSS changed
Apr 27, 2026 - 20:07 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 19:59 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25557
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

xfrm: clear trailing padding in build_polexpire()

build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire.

The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

AnalysisAI

Kernel heap memory disclosure in the Linux kernel's xfrm (IPsec) subsystem exposes uninitialized heap bytes to local unprivileged users via netlink multicast. The build_polexpire() function omits the memset_after() call that its counterpart build_expire() correctly applies, leaving trailing padding bytes of struct xfrm_user_polexpire uninitialized before broadcasting the structure to XFRMNLGRP_EXPIRE listeners. Any local user able to subscribe to that netlink multicast group on a system running IPsec with expiring policies can capture these notifications and read arbitrary kernel heap contents. No public exploit has been identified at time of analysis, and EPSS is extremely low at 0.02% (7th percentile), indicating negligible automated exploitation activity.

Technical ContextAI

The Linux kernel's xfrm subsystem implements IPsec transforms and security policy management, using NETLINK_XFRM sockets and multicast groups to notify userspace daemons (racoon, strongSwan, etc.) of lifecycle events. When a security policy expires, build_polexpire() constructs a struct xfrm_user_polexpire and sends it via netlink to the XFRMNLGRP_EXPIRE group. That struct contains a __u8 hard field near its end, followed by compiler-inserted padding bytes for alignment. The kernel allocates this struct from the heap (kmalloc), sets the hard field, but never zeroes the trailing padding - unlike build_expire(), which explicitly calls memset_after(hard, ...) after setting the same field in the analogous SA-expiry struct. The root cause class is uninitialized kernel memory disclosure (analogous to CWE-200/CWE-909), mediated by a missing memset call. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across all stable series from initial commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, Linux 2.6.12) through the patched releases.

RemediationAI

Upgrade to a patched stable Linux kernel release: 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0. Upstream fix commits are available at git.kernel.org/stable - for example ac6985903db047eaff54db929e4bf6b06782788e (6.6 series), e1af65c669ebb1666c54576614c01a7f9ffcfff6, 71a98248c63c535eaa4d4c22f099b68d902006d0, b1dfd6b27df35ef4f87825aa5f607378d23ff0f2, eda30846ea54f8ed218468e5480c8305ca645e37, and c221ed63a2769a0af8bd849dfe25740048f34ef4. Ubuntu users should apply USN-8567-1; Siemens product users should follow SSA-019113 and SSA-082556. Where immediate patching is not possible, restricting CAP_NET_ADMIN and blocking unprivileged processes from creating NETLINK_XFRM sockets (via seccomp policy or SELinux/AppArmor rules) eliminates the attack surface - note this will break legitimate IPsec management tools such as strongSwan or racoon and requires testing before deployment. Disabling xfrm policy lifetime limits (so policies never expire) prevents build_polexpire() from being invoked, but this is operationally disruptive to IPsec lifecycle management.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31664 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy