CVE-2026-31517

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31517", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.108Z", "datePublished": "2026-04-22T13:54:33.522Z", "dateUpdated": "2026-05-11T22:10:19.646Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:19.646Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly\n\nIn iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner\npacket 'newskb' that is being reassembled. First a zero-copy approach is\ntried if it succeeds then newskb becomes non-linear.\n\nWhen a subsequent fragment in the same datagram does not meet the\nfast-path conditions, a memory copy is performed. It calls skb_put() to\nappend the data and as newskb is non-linear it triggers\nSKB_LINEAR_ASSERT check.\n\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Call Trace:\n <IRQ>\n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n </IRQ>\n <TASK>\n\nFix this by checking if the skb is non-linear. If it is, linearize it by\ncalling skb_linearize(). As the initial allocation of newskb originally\nreserved enough tailroom for the entire reassembled packet we do not\nneed to check if we have enough tailroom or extend it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "versions": [{"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "lessThan": "33a7b36268933c75bdc355e5531951e0ea9f1951", "status": "affected", "versionType": "git"}, {"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "lessThan": "7fdfe8f6efeb0e1200e22a903f2471539f54522b", "status": "affected", "versionType": "git"}, {"version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "lessThan": "0b352f83cabfefdaafa806d6471f0eca117dc7d5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/33a7b36268933c75bdc355e5531951e0ea9f1951"}, {"url": "https://git.kernel.org/stable/c/7fdfe8f6efeb0e1200e22a903f2471539f54522b"}, {"url": "https://git.kernel.org/stable/c/0b352f83cabfefdaafa806d6471f0eca117dc7d5"}], "title": "xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "33a7b36268933c75bdc355e5531951e0ea9f1951", "status": "affected", "version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "versionType": "git"}, {"lessThan": "7fdfe8f6efeb0e1200e22a903f2471539f54522b", "status": "affected", "version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "versionType": "git"}, {"lessThan": "0b352f83cabfefdaafa806d6471f0eca117dc7d5", "status": "affected", "version": "5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_iptfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BA62FCD-8829-4508-AFE2-0C12960267CD", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.14.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*", "matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly\n\nIn iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner\npacket 'newskb' that is being reassembled. First a zero-copy approach is\ntried if it succeeds then newskb becomes non-linear.\n\nWhen a subsequent fragment in the same datagram does not meet the\nfast-path conditions, a memory copy is performed. It calls skb_put() to\nappend the data and as newskb is non-linear it triggers\nSKB_LINEAR_ASSERT check.\n\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Call Trace:\n <IRQ>\n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n </IRQ>\n <TASK>\n\nFix this by checking if the skb is non-linear. If it is, linearize it by\ncalling skb_linearize(). As the initial allocation of newskb originally\nreserved enough tailroom for the entire reassembled packet we do not\nneed to check if we have enough tailroom or extend it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: iptfs: corrige el p\u00e1nico de skb_put() en skb no lineal durante el reensamblaje\n\nEn iptfs_reassem_cont(), IP-TFS intenta adjuntar datos al nuevo paquete interno \u2019newskb\u2019 que est\u00e1 siendo reensamblado. Primero se intenta un enfoque de copia cero; si tiene \u00e9xito, entonces newskb se vuelve no lineal.\n\nCuando un fragmento subsiguiente en el mismo datagrama no cumple las condiciones de ruta r\u00e1pida, se realiza una copia en memoria. Llama a skb_put() para adjuntar los datos y, como newskb es no lineal, activa la comprobaci\u00f3n SKB_LINEAR_ASSERT.\n\n Oops: c\u00f3digo de operaci\u00f3n inv\u00e1lido: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Traza de Llamadas:\n [IRQ]\n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x 1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x 1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x 116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n [/IRQ]\n [TASK]\n\nSoluciona esto comprobando si el skb es no lineal. Si lo es, lineal\u00edzalo llamando a skb_linearize(). Dado que la asignaci\u00f3n inicial de newskb originalmente reserv\u00f3 suficiente espacio de cola para todo el paquete reensamblado, no necesitamos comprobar si tenemos suficiente espacio de cola o extenderlo."}], "id": "CVE-2026-31517", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-22T14:16:51.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b352f83cabfefdaafa806d6471f0eca117dc7d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33a7b36268933c75bdc355e5531951e0ea9f1951"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7fdfe8f6efeb0e1200e22a903f2471539f54522b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly", "id": "2460667", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460667"}, "csaw": false, "cwe": "CWE-788", "details": ["A flaw was found in the Linux kernel's IP-TFS (IP-Transparent Fragmentation Service) subsystem. A remote attacker could send specially crafted network packets that, during the reassembly process, cause the kernel to attempt an invalid operation on a network buffer. This improper handling of network packet fragments can lead to a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31517", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31517\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31517\nhttps://lore.kernel.org/linux-cve-announce/2026042210-CVE-2026-31517-e189@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7,33a7b36268933c75bdc355e5531951e0ea9f1951)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7,7fdfe8f6efeb0e1200e22a903f2471539f54522b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7,0b352f83cabfefdaafa806d6471f0eca117dc7d5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T03:22:31.386405+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the IPTFS reassembly fix, using your distribution\u2019s security update channel.", "If an immediate update is not possible, disable IPTFS processing either by rebuilding the kernel without CONFIG_IP_TFS or setting the relevant sysctl to zero to prevent the vulnerable code path from executing.", "Block inbound fragmented IP traffic that would trigger reassembly, for example by enforcing a maximum packet size or filtering fragmented packets at a firewall, and monitor system logs for panic events."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service (kernel crash)"}, "threat_synthesis": {"affected_systems": "All Linux kernel installations that enable the IPTFS feature are affected. The advisory does not limit the vulnerability to a specific kernel release, but any kernel containing the vulnerable code path\u2014such as the current stable series and upcoming releases\u2014must be considered at risk until the patch is applied.", "description_and_impact": "The flaw resides in the Linux kernel\u2019s IPTFS reassembly logic, where a non\u2011linear socket buffer is inadvertently appended using skb_put. This causes the SKB_LINEAR_ASSERT check to trip, producing an Oops and a kernel panic. An attacker can exploit this by fabricating IP fragments that trigger the reassembly path, forcing a system reboot or halt and disrupting availability for the affected host.", "risk_and_exploitability": "The EPSS score is reported as less than 1%, indicating a very low but non\u2011zero likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects medium severity. Based on the description, it is inferred that the attack vector involves crafting IP fragments over the network, and exploitation requires network\u2011level access to send these fragments; no local privileges or advanced conditions are mentioned. The kernel panic is the sole observed impact, rendering the system temporarily unavailable until it is rebooted or the fault is mitigated."}}}}, "created": "2026-04-22T18:45:24.009318+00:00", "updated": "2026-04-29T03:30:15.940313+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}