CVE-2026-31518: esp: fix skb leak with espintcp and async crypto
esp: fix skb leak with espintcp and async crypto
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.134.1-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In esp_output_done for asynchronous crypto, drop the skb when esp_output_tail_tcp returns an error, preventing the skb leak when the espintcp TX queue is full.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31518?
CVE-2026-31518 is classified as a medium severity vulnerability.
How do I fix CVE-2026-31518?
To fix CVE-2026-31518, update your Linux kernel to a version that includes the patch for this vulnerability.
What is the impact of CVE-2026-31518 on the Linux kernel?
CVE-2026-31518 can lead to a resource leak in the espintcp module, causing degraded system performance.
Which Linux kernel versions are affected by CVE-2026-31518?
CVE-2026-31518 affects multiple versions of the Linux kernel that utilize espintcp with asynchronous crypto.
How does CVE-2026-31518 affect networking functionality?
CVE-2026-31518 can cause the transmission queue to become full, leading to errors without freeing network buffers.