CVE-2026-31517: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31517 is a kernel panic vulnerability in the Linux kernel's xfrm IP-TFS (IP Traffic Flow Security) reassembly subsystem, caused by an invalid skb_put() call on a non-linear socket buffer during packet reassembly. It affects Linux kernel versions 6.14, 6.14.1 through 6.18.20, 6.19 through 6.19.10, and pre-release 7.0 release candidates (rc1–rc7). The vulnerability was published on April 22, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in the iptfs_reassem_cont() function within the xfrm_iptfs kernel module, classified under CWE-788 (Access of Memory Location After End of Buffer) and CWE-401 (Missing Release of Memory after Effective Lifetime). During IP-TFS packet reassembly, the code first attempts a zero-copy approach to append fragment data to the reassembled newskb; if successful, newskb becomes non-linear. When a subsequent fragment in the same datagram fails fast-path conditions and falls back to a memory-copy path, skb_put() is called on the now non-linear buffer, triggering the SKB_LINEAR_ASSERT kernel check and causing an Oops: invalid opcode kernel panic. The fix involves checking whether newskb is non-linear before calling skb_put(), and if so, calling skb_linearize() first — which is safe because the initial newskb allocation reserves sufficient tailroom for the full reassembled packet (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (system crash), resulting in a complete denial of service for the affected host. The vulnerability has a HIGH availability impact with no confidentiality or integrity impact, meaning attackers cannot leverage it for data exfiltration or unauthorized modification. Systems acting as IPsec VPN gateways or secure network gateways with IP-TFS enabled are particularly at risk, as a crash would disrupt all network traffic flowing through them (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local network access with low privileges and the ability to send specially crafted fragmented IPsec packets to a system with IP-TFS enabled (GitHub Advisory).

1. Reconnaissance: Identify target systems running vulnerable Linux kernel versions (6.14–6.18.20, 6.19–6.19.10, or 7.0-rc1 through rc7) that have IPsec with IP-TFS (xfrm_iptfs module) enabled, such as VPN gateways or IPsec-secured routers.
2. Establish network access: Gain local network access to the target, sufficient to send IPsec ESP packets that will be processed by the vulnerable system's xfrm stack.
3. Craft fragmented IPsec packets: Construct a sequence of IP-TFS fragmented IPsec packets where the first fragment triggers the zero-copy path (making newskb non-linear), and a subsequent fragment in the same datagram fails the fast-path conditions, forcing the memory-copy code path.
4. Trigger the panic: Transmit the crafted packet sequence to the target. The iptfs_reassem_cont() function calls skb_put() on the non-linear newskb, triggering SKB_LINEAR_ASSERT and causing a kernel panic (Oops: invalid opcode), crashing the system (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing Oops: invalid opcode: 0000 [#1] SMP NOPTI with a call trace including skb_put+0x3c/0x40, iptfs_reassem_cont, iptfs_input_ordered, iptfs_input, and xfrm_input.
• Logs: System crash/reboot events correlated with IPsec traffic processing, particularly around xfrm4_esp_rcv and ip_protocol_deliver_rcu in the call stack.
• Network: Unusual or malformed fragmented IPsec ESP packets arriving at the system, especially sequences where fragments alternate between zero-copy-eligible and non-eligible conditions.
• Process/System: Unexpected system reboots or kernel panics on hosts running IPsec VPN or IP-TFS-enabled configurations (GitHub Advisory).

Upgrade the Linux kernel to a patched version: 6.18.21 or later (for systems on the 6.14.1–6.18.x branch), 6.19.11 or later (for systems on the 6.19.x branch), or 7.0 stable release. Patches are available via three kernel git commits: 0b352f83cabfefdaafa806d6471f0eca117dc7d5, 33a7b36268933c75bdc355e5531951e0ea9f1951, and 7fdfe8f6efeb0e1200e22a903f2471539f54522b. As a temporary workaround if patching is not immediately possible, disable or restrict IP-TFS functionality if it is not operationally required, and implement network segmentation to limit IPsec traffic sources and destinations (GitHub Advisory, Red Hat Bugzilla).