CVE-2026-31664: xfrm: clear trailing padding in build_polexpire()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: clear trailing padding in buildpolexpire()
buildexpire() clears the trailing padding bytes of struct xfrmuserexpire after setting the hard field via memsetafter(), but the analogous function buildpolexpire() does not do this for struct xfrmuserpolexpire.
The padding bytes after the u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRPEXPIRE listeners, leaking kernel heap memory contents.
Add the missing memsetafter() call, matching buildexpire().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In build_polexpire(), clear the trailing padding bytes after the __u8 hard field (add the missing memset_after() call) so uninitialized heap padding is not sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners.
Linux kernel (xfrm) Add memset_after() call to clear trailing padding bytes in build_polexpire() = memset_after()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31664?
CVE-2026-31664 is classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2026-31664?
To mitigate CVE-2026-31664, update your Linux kernel to the latest stable version that addresses this vulnerability.
What type of vulnerability is CVE-2026-31664?
CVE-2026-31664 is a clearing trailing padding vulnerability in the xfrm subsystem of the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2026-31664?
CVE-2026-31664 affects multiple versions of the Linux kernel prior to the security patch release addressing this issue.
Is CVE-2026-31664 a remote code execution vulnerability?
CVE-2026-31664 is not classified as a remote code execution vulnerability, but it can impact the security of systems using the affected kernel.