Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view sensitive information from the system's memory. The issue occurs when the kernel sends certain network policy expiration notifications to applications, accidentally including small amounts of uninitialized data from the kernel's internal memory. This could potentially leak cryptographic keys or other sensitive data to an unauthorized local observer.
Technical details
An information leak exists in the Linux kernel's XFRM (IPsec) implementation within net/xfrm/xfrm_user.c. The function build_polexpire() fails to initialize trailing padding bytes in the 'xfrm_user_polexpire' structure before sending it to userspace via netlink multicast (XFRMNLGRP_EXPIRE). A local attacker with the ability to listen to these netlink messages can capture uninitialized kernel heap memory. The fix involves using memset_after() or an equivalent manual memset to ensure all padding bytes are zeroed before transmission.
Affected products
- Linux Linux Kernel versions from 2.6.12.1 up to 6.1.169; 6.2 up to 6.6.135; 6.7 up to 6.12.82; 6.13 up to 6.18.23; 6.19 up to 6.19.13
Timeline
- 2026-03-26: other: Patch authored
- 2026-04-24: disclosed: Initial publication of CVE-2026-31664
- 2026-04-24: advisory
- 2026-06-01: patched: Final stable tree updates applied
References
- https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0
- https://git.kernel.org/stable/c/a5127501c8d30b5728791b1e340284ca5c9cc4bd
- https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e
- https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2
- https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4
- https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6
- https://git.kernel.org/stable/c/e6f4ffe8596947a595c9544e73a73adcb0568b88