Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or potentially access sensitive information. The issue occurs when the system handles specific types of compressed network security associations, leading to an 'out-of-bounds' memory read. This could disrupt network operations or impact the overall stability of the server.
Technical details
A vulnerability exists in pfkey_msg2xfrm_state() within the Linux kernel's net/key/af_key.c. When handling IPComp (SADB_X_SATYPE_IPCOMP), the function allocates an xfrm_algo object but fails to initialize the alg_key_len field. Because IPComp does not use keys, this field remains populated with uninitialized slab data. When the state is subsequently cloned during an XFRM_MSG_MIGRATE operation, xfrm_algo_clone() uses the garbage value in alg_key_len to determine the length for kmemdup(), resulting in a slab-out-of-bounds read. This can be triggered by adding an IPComp SA via PF_KEY and then performing a migration. The issue has been patched by explicitly initializing alg_key_len to zero.
Affected products
- Linux Linux Kernel 7.1.0-rc6-g903db046d557
Timeline
- 2026-06-08: other: Vulnerability fixed in source code
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/01b9115b55018123ef2449ac4951f89147a8428e
- https://git.kernel.org/stable/c/273c06b81d2e902b21acc801ae18c8276c8a9b69
- https://git.kernel.org/stable/c/3f63d1752d90c0e28be931a48ab5d89bc97d637d
- https://git.kernel.org/stable/c/58e82fc3dedb57b1432292504415b224fd2d6acb
- https://git.kernel.org/stable/c/6de2a650917bedaaefd65b17cede83c5e2c1dedd
- https://git.kernel.org/stable/c/cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e
- https://git.kernel.org/stable/c/d129c3177d7b1138fd5066fcc63a698b3ba415b0