CVE-2026-31664
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire. The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents. Add the missing memset_after() call, matching build_expire().
How to fix
- linux linux_kernel6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13 or later
- git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0
- git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e
- git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2
- git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4
- git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6
- git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.12.1 ≤ v < 6.1.169, 6.2 ≤ v < 6.6.135, 6.7 ≤ v < 6.12.82, 6.13 ≤ v < 6.18.23, 6.19 ≤ v < 6.19.13, 2.6.12, 7.0 | 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.