# CVE-2026-31515: Linux Kernel buffer overflow in af_key pfkey_send_migrate

Source: https://junglewise.ai/threats/cve-2026-31515-linux-kernel-buffer-overflow-in-af-key-pfkey-send-migrate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-31515 · Severity: medium · CVSS 5.5 · Published 2026-04-22

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system processes specific IPsec security protocol requests without properly verifying the data size, leading to a kernel panic. This primarily impacts system availability, potentially causing service disruptions or reboots in affected environments, including certain Siemens industrial controllers.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-31515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31515 being exploited in the wild.

**How severe is CVE-2026-31515?** Medium severity, with a CVSS score of 5.5, published 22 April 2026.

**Which products and versions are affected?** Linux Kernel Fixed in 7b18692, 83f644e, 8ddf8de, d0c5aa8, d3225e6, e06b596, eb2d16a, ee836e8; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-31515?** A patch was published on 2026-04-02: Patches committed to stable kernel branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31515 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-31515?** Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Linux kernel's af_key implementation, specifically within the pfkey_send_migrate() function. The root cause is a failure to validate address families (old/new families) before calling set_ipsecrequest(), combined with the truncation of the @family argument. This leads to an incorrect calculation of the required socket buffer (skb) size, resulting in an skb_over_panic when skb_put() is called. A local attacker with low privileges can trigger this crash, leading to a Denial of Service (DoS). The issue has been resolved by adding early family validation and correcting the family argument type to sa_family_t.

## Affected products

- Linux Linux Kernel Fixed in 7b18692, 83f644e, 8ddf8de, d0c5aa8, d3225e6, e06b596, eb2d16a, ee836e8
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-03-14: disclosed: Initial patch authored by Eric Dumazet
- 2026-04-02: patched: Patches committed to stable kernel branches
- 2026-04-22: advisory: CVE published

## References

- [https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028](https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028)
- [https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34](https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34)
- [https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16](https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16)
- [https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e](https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e)
- [https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5](https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5)
- [https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8](https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8)
- [https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786](https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)