CVE-2026-31518: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31518 is a memory leak vulnerability in the Linux kernel's ESP (Encapsulating Security Payload) implementation affecting the espintcp subsystem with asynchronous crypto operations. When the TX queue for espintcp is full, esp_output_tail_tcp returns an error without freeing the socket buffer (skb); with asynchronous crypto (esp_output_done), the skb is never dropped, causing a resource leak. Affected kernel versions span 5.6 through 6.19 and 7.0-rc variants. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). In the synchronous crypto path, the common xfrm output code handles packet dropping on error; however, in the asynchronous path (esp_output_done), no equivalent cleanup occurs when esp_output_tail_tcp signals an error due to a full TX queue, leaving the skb unreleased. Exploitation requires local access with low privileges — an attacker must be able to trigger the async crypto path and repeatedly fill the espintcp TX queue to accumulate leaked socket buffers (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes progressive memory exhaustion on the affected host, leading to denial of service through system crashes or severe degradation of IPsec-based network services. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High). The scope is confined to the local system, with no direct path to lateral movement, though a crashed or degraded IPsec gateway could disrupt network-level security controls (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.024%, reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface.

Apply the upstream kernel patches available for all affected stable branches. Fixed versions include: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and the 7.0 final release. Patches have been committed to stable kernel branches via git.kernel.org and are also available through distribution channels including Amazon Linux 2023 and Debian. As a temporary measure, restrict local user access on systems running IPsec with espintcp and asynchronous crypto, and monitor system memory usage for unusual depletion patterns (GitHub Advisory, Amazon Linux Advisory).