CVE-2026-31471

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31471", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.098Z", "datePublished": "2026-04-22T13:53:59.595Z", "dateUpdated": "2026-08-05T12:22:50.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:50.697Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: only publish mode_data after clone setup\n\niptfs_clone_state() stores x->mode_data before allocating the reorder\nwindow. If that allocation fails, the code frees the cloned state and\nreturns -ENOMEM, leaving x->mode_data pointing at freed memory.\n\nThe xfrm clone unwind later runs destroy_state() through x->mode_data,\nso the failed clone path tears down IPTFS state that clone_state()\nalready freed.\n\nKeep the cloned IPTFS state private until all allocations succeed so\nfailed clones leave x->mode_data unset. The destroy path already\nhandles a NULL mode_data pointer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local NETLINK_XFRM configuration messages, including creating an IP-TFS ESP SA and triggering XFRM_MSG_MIGRATE cloning. It is not reached directly by remote packets.\nAC:L - The attacker controls the relevant XFRM/IP-TFS objects and can repeatedly trigger the clone failure path, including by using a large reorder window and memory pressure. There is no race requiring conditions outside the attacker's control, and uncertainty favors the higher severity option.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN in the target network namespace. Because this is reachable from an unprivileged user via user and network namespaces on systems that allow them, this is Low privileges rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker sends the needed netlink messages directly.\nS:U - The impact is within the kernel security authority on the same host. This is a standard local kernel memory corruption issue, not a boundary crossing such as guest-to-host escape.\nC:H - The bug leaves x->mode_data pointing to freed IPTFS state and later dereferences it during destroy_state(), creating a use-after-free. Kernel UAFs are defensibly scored as high confidentiality impact because they can be shaped into memory disclosure primitives.\nI:H - The dangling IPTFS object is later used for locks, timers, queue teardown, skb freeing, and kfree operations, giving memory corruption and double-free style behavior. Kernel UAF memory corruption is defensibly scored as high integrity impact.\nA:H - The failed clone unwind can dereference freed memory and tear down already-freed IPTFS state, making kernel oops/panic or heap corruption likely. Any such kernel crash is high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "versions": [{"version": "6be02e3e4f376fea468846c8562655ca5ee18204", "lessThan": "371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1", "status": "affected", "versionType": "git"}, {"version": "6be02e3e4f376fea468846c8562655ca5ee18204", "lessThan": "5784a1e2889c9525a8f036cb586930e232170bf7", "status": "affected", "versionType": "git"}, {"version": "6be02e3e4f376fea468846c8562655ca5ee18204", "lessThan": "d849a2f7309fc0616e79d13b008b0a47e0458b6e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1"}, {"url": "https://git.kernel.org/stable/c/5784a1e2889c9525a8f036cb586930e232170bf7"}, {"url": "https://git.kernel.org/stable/c/d849a2f7309fc0616e79d13b008b0a47e0458b6e"}], "title": "xfrm: iptfs: only publish mode_data after clone setup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1", "status": "affected", "version": "6be02e3e4f376fea468846c8562655ca5ee18204", "versionType": "git"}, {"lessThan": "5784a1e2889c9525a8f036cb586930e232170bf7", "status": "affected", "version": "6be02e3e4f376fea468846c8562655ca5ee18204", "versionType": "git"}, {"lessThan": "d849a2f7309fc0616e79d13b008b0a47e0458b6e", "status": "affected", "version": "6be02e3e4f376fea468846c8562655ca5ee18204", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A92793EC-8117-409C-996C-47A04124C722", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: only publish mode_data after clone setup\n\niptfs_clone_state() stores x->mode_data before allocating the reorder\nwindow. If that allocation fails, the code frees the cloned state and\nreturns -ENOMEM, leaving x->mode_data pointing at freed memory.\n\nThe xfrm clone unwind later runs destroy_state() through x->mode_data,\nso the failed clone path tears down IPTFS state that clone_state()\nalready freed.\n\nKeep the cloned IPTFS state private until all allocations succeed so\nfailed clones leave x->mode_data unset. The destroy path already\nhandles a NULL mode_data pointer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: iptfs: solo publicar mode_data despu\u00e9s de configurar el clon\n\niptfs_clone_state() almacena x -> mode_data antes de asignar la ventana de reordenamiento. Si esa asignaci\u00f3n falla, el c\u00f3digo libera el estado clonado y devuelve -ENOMEM, dejando x -> mode_data apuntando a memoria liberada.\n\nEl desenrollado del clon xfrm m\u00e1s tarde ejecuta destroy_state() a trav\u00e9s de x -> mode_data, por lo que la ruta de clonaci\u00f3n fallida desmantela el estado IPTFS que clone_state() ya liber\u00f3.\n\nMantener el estado IPTFS clonado privado hasta que todas las asignaciones tengan \u00e9xito para que los clones fallidos dejen x -> mode_data sin establecer. La ruta de destrucci\u00f3n ya maneja un puntero mode_data NULL."}], "id": "CVE-2026-31471", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-22T14:16:43.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5784a1e2889c9525a8f036cb586930e232170bf7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d849a2f7309fc0616e79d13b008b0a47e0458b6e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: xfrm: iptfs: only publish mode_data after clone setup", "id": "2460694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460694"}, "csaw": false, "cwe": "CWE-1341", "details": ["A flaw was found in the Linux kernel, specifically within the `xfrm: iptfs` component. This vulnerability arises during the cloning of network security states, where an error in memory allocation can lead to the system attempting to use or free memory that has already been released. This memory corruption could allow an attacker to cause a denial of service, potentially leading to system instability or unresponsiveness."], "name": "CVE-2026-31471", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31471\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31471\nhttps://lore.kernel.org/linux-cve-announce/2026042254-CVE-2026-31471-d8ba@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6be02e3e4f376fea468846c8562655ca5ee18204,371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6be02e3e4f376fea468846c8562655ca5ee18204,5784a1e2889c9525a8f036cb586930e232170bf7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6be02e3e4f376fea468846c8562655ca5ee18204,d849a2f7309fc0616e79d13b008b0a47e0458b6e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T16:45:21.251347+00:00", "updated": "2026-05-06T23:30:16.491716+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}