Junglewise Threat Intelligence

CVE-2026-31533: Linux Kernel use-after-free in net/tls encryption error path

CVE-2026-31533 · Severity: critical · CVSS 9.8 · Published 2026-04-23

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's TLS (Transport Layer Security) implementation, which is used to secure network communications. An error in how the system handles busy encryption requests can lead to a system crash or allow an attacker to execute unauthorized code. This could result in a complete compromise of the affected system, impacting data confidentiality and service availability.

Technical details

A use-after-free (UAF) vulnerability exists in the net/tls module of the Linux kernel, specifically within the tls_do_encryption() function. The issue stems from a double-cleanup of 'encrypt_pending' and scatterlist entries when crypto_aead_encrypt() returns -EBUSY and the subsequent async wait returns an error. This double-decrement corrupts the pending request counter, causing the kernel to prematurely free TLS record structures while asynchronous callbacks are still pending. An attacker can trigger this condition to achieve a use-after-free when the delayed callback executes on freed memory. Patches have been released for multiple Linux stable branches (e.g., commits starting with 02f3ecad, 0e43e0a3, 2694d408).

Affected products

  • Linux Linux Kernel Affected by commit 859054147318; fixed in various stable branches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-04-03: disclosed: Initial patch submission by Muhammad Alifa Ramdhan
  • 2026-04-18: patched: Commits merged into Linux stable trees by Greg Kroah-Hartman
  • 2026-04-23: advisory: CVE-2026-31533 published

References

Related threats