CVE-2026-31515: Linux Kernel buffer overflow in af_key pfkey_send_migrate

CVE-2026-31515 · Severity: medium · CVSS 5.5 · Published 2026-04-22

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system processes specific IPsec security protocol requests without properly verifying the data size, leading to a kernel panic. This primarily impacts system availability, potentially causing service disruptions or reboots in affected environments, including certain Siemens industrial controllers.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31515 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31515 being exploited in the wild.
How severe is CVE-2026-31515?
Medium severity, with a CVSS score of 5.5, published 22 April 2026.
Which products and versions are affected?
Linux Kernel Fixed in 7b18692, 83f644e, 8ddf8de, d0c5aa8, d3225e6, e06b596, eb2d16a, ee836e8; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-31515?
A patch was published on 2026-04-02: Patches committed to stable kernel branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31515 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-31515?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Linux kernel's af_key implementation, specifically within the pfkey_send_migrate() function. The root cause is a failure to validate address families (old/new families) before calling set_ipsecrequest(), combined with the truncation of the @family argument. This leads to an incorrect calculation of the required socket buffer (skb) size, resulting in an skb_over_panic when skb_put() is called. A local attacker with low privileges can trigger this crash, leading to a Denial of Service (DoS). The issue has been resolved by adding early family validation and correcting the family argument type to sa_family_t.

Affected products

  • Linux Linux Kernel Fixed in 7b18692, 83f644e, 8ddf8de, d0c5aa8, d3225e6, e06b596, eb2d16a, ee836e8
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-14: disclosed: Initial patch authored by Eric Dumazet
  • 2026-04-02: patched: Patches committed to stable kernel branches
  • 2026-04-22: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.