CVE-2026-31472: xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
Add validation of the inner IPv4 packet totlen and ihl fields parsed from decrypted IPTFS payloads in inputprocesspayload(). A crafted ESP packet containing an inner IPv4 header with totlen=0 causes an infinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the data offset never advances and the while(data < tail) loop never terminates, spinning forever in softirq context.
Reject inner IPv4 packets where totlen < ihl4 or ihl4 < sizeof(struct iphdr), which catches both the totlen=0 case and malformed ihl values. The normal IP stack performs this validation in iprcvcore(), but IPTFS extracts and processes inner packets before they reach that layer.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems using the Linux kernel IPTFS receive path are exposed when they process decrypted IPTFS payloads containing inner IPv4 packets. The issue is triggered during handling of crafted ESP traffic.
What does an attacker need to exploit it?
An attacker needs to provide a crafted ESP packet whose decrypted IPTFS payload contains an invalid inner IPv4 header, such as one with tot_len set to zero. Exploitation requires low privileges according to the supplied CVSS vector and does not require user interaction.
What is the impact of successful exploitation?
A malformed inner IPv4 packet can cause an infinite loop in softirq context because payload processing does not advance its data offset. This results in a denial of service through resource exhaustion or a CPU spin.
What should be done if patching cannot happen immediately?
The provided data identifies a patch as available. No temporary mitigation or configuration workaround is specified.