CVE-2026-31515
Description
In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
How to fix
- linux linux_kernel5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11 or later
- git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028
- git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34
- git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16
- git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e
- git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5
- git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8
- git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786
- git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.21.1 ≤ v < 5.10.253, 5.11 ≤ v < 5.15.203, 5.16 ≤ v < 6.1.168, 6.2 ≤ v < 6.6.131, 6.7 ≤ v < 6.12.80, 6.13 ≤ v < 6.18.21, 6.19 ≤ v < 6.19.11, 2.6.21, 7.0 | 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.