Junglewise Threat Intelligence

CVE-2026-31515: Linux Kernel buffer overflow in af_key pfkey_send_migrate

CVE-2026-31515 · Severity: medium · CVSS 5.5 · Published 2026-04-22

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system processes specific IPsec security protocol requests without properly verifying the data size, leading to a kernel panic. This primarily impacts system availability, potentially causing service disruptions or reboots in affected environments, including certain Siemens industrial controllers.

Technical details

A vulnerability exists in the Linux kernel's af_key implementation, specifically within the pfkey_send_migrate() function. The root cause is a failure to validate address families (old/new families) before calling set_ipsecrequest(), combined with the truncation of the @family argument. This leads to an incorrect calculation of the required socket buffer (skb) size, resulting in an skb_over_panic when skb_put() is called. A local attacker with low privileges can trigger this crash, leading to a Denial of Service (DoS). The issue has been resolved by adding early family validation and correcting the family argument type to sa_family_t.

Affected products

  • Linux Linux Kernel Fixed in 7b18692, 83f644e, 8ddf8de, d0c5aa8, d3225e6, e06b596, eb2d16a, ee836e8
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-14: disclosed: Initial patch authored by Eric Dumazet
  • 2026-04-02: patched: Patches committed to stable kernel branches
  • 2026-04-22: advisory: CVE published

References

Related threats