CVE-2026-31533: Linux Kernel use-after-free in net/tls encryption error path

CVE-2026-31533 · Severity: critical · CVSS 9.8 · Published 2026-04-23

A vulnerability exists in the Linux kernel's TLS (Transport Layer Security) implementation, which is used to secure network communications. An error in how the system handles busy encryption requests can lead to a system crash or allow an attacker to execute unauthorized code. This could result in a complete compromise of the affected system, impacting data confidentiality and service availability.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31533 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31533 being exploited in the wild.
How severe is CVE-2026-31533?
Critical severity, with a CVSS score of 9.8, published 23 April 2026.
Which products and versions are affected?
Linux Kernel Affected by commit 859054147318; fixed in various stable branches; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-31533?
A patch was published on 2026-04-18: Commits merged into Linux stable trees by Greg Kroah-Hartman Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31533 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-31533?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the net/tls module of the Linux kernel, specifically within the tls_do_encryption() function. The issue stems from a double-cleanup of 'encrypt_pending' and scatterlist entries when crypto_aead_encrypt() returns -EBUSY and the subsequent async wait returns an error. This double-decrement corrupts the pending request counter, causing the kernel to prematurely free TLS record structures while asynchronous callbacks are still pending. An attacker can trigger this condition to achieve a use-after-free when the delayed callback executes on freed memory. Patches have been released for multiple Linux stable branches (e.g., commits starting with 02f3ecad, 0e43e0a3, 2694d408).

Affected products

  • Linux Linux Kernel Affected by commit 859054147318; fixed in various stable branches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-04-03: disclosed: Initial patch submission by Muhammad Alifa Ramdhan
  • 2026-04-18: patched: Commits merged into Linux stable trees by Greg Kroah-Hartman
  • 2026-04-23: advisory: CVE-2026-31533 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.