Linux Kernel CVE-2026-31671

The affected code resides in net/xfrm/xfrm_user.c, specifically the build_report() function within the Linux kernel's XFRM (IP transform) subsystem, which manages IPsec policies and states exposed to userspace via Netlink sockets. The struct xfrm_user_report layout places a single-byte __u8 proto field immediately before a struct xfrm_selector; C compiler alignment rules insert three implicit padding bytes between these fields. Because the code populated the structure by assigning individual members rather than zero-initializing it first, those three padding bytes retained whatever stale kernel stack or heap data resided at that address at call time - constituting a classic uninitialized-memory information disclosure. The fix is to zero the entire structure (e.g., memset or = {0}) before filling in fields. CWE-401 (Missing Release of Memory) is applied in the NVD data, though CWE-908 (Use of Uninitialized Resource) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) more precisely describes this root cause. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.