CVE-2026-31663: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31663 is a use-after-free vulnerability in the Linux kernel's xfrm (IPsec) subsystem, classified as xfrm: hold dev ref until after transport_finish NF_HOOK. It was published on April 24, 2026, and affects Linux kernel versions from approximately 3.2.100 through 6.18.x (before 6.18.23) and 6.19.x (before 6.19.13), as well as 7.0 release candidates. The flaw arises when xfrm_input_resume() prematurely releases a device reference after asynchronous cryptographic operations complete, before the socket buffer (skb) finishes processing through the netfilter hook. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-826 (Premature Release of Resource During Expected Lifetime). After async crypto completes, xfrm_input_resume() calls dev_put() immediately upon re-entry, before the skb reaches transport_finish. The skb->dev pointer is subsequently used inside NF_HOOK and its okfn, creating a race condition with device teardown — a classic use-after-free scenario. The fix relocates the dev_put() call to after the NF_HOOK invocation in transport_finish, using a saved device pointer to handle cases where NF_HOOK may consume the skb (covering NF_DROP, NF_QUEUE, and NF_STOLEN paths). For non-transport exits and secondary async return points, the reference is released inline when async is set (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger kernel crashes (denial of service) or potentially achieve kernel-level code execution through memory corruption in the xfrm/IPsec packet processing path. The vulnerability impacts confidentiality, integrity, and availability at the highest level (all rated High in CVSS), as kernel-level compromise could expose all data on the system, allow arbitrary modification of kernel memory, and cause system instability or crashes. Systems using IPsec with asynchronous cryptographic hardware acceleration are particularly at risk (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and specific timing to race device teardown against IPsec packet processing, making opportunistic exploitation more difficult. The EPSS score is approximately 0.017% (3rd percentile), indicating a low near-term exploitation probability. CVE-2026-31663 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

Patches are available in Linux kernel stable trees via commits 0f451b43c88bf2b9c038b414be580efee42e031b, 1c428b03840094410c5fb6a5db30640486bbbfcb, and 5002beda5cac69d522dc54da0d5d463ed9c963d2. Fixed versions include Linux 6.18.23+, 6.19.13+, and 7.0+. As an interim workaround for systems that cannot be updated immediately, administrators should consider disabling asynchronous cryptographic acceleration in IPsec configurations if operationally feasible, or restricting IPsec usage to trusted network segments. Distribution-specific backports should be monitored from vendors such as Red Hat, Ubuntu, and SUSE (Red Hat Bugzilla, GitHub Advisory).

The vulnerability was reported to Red Hat's security response team via OSIDB on April 24, 2026, and assigned high severity/priority in their Bugzilla tracker. The upstream kernel CVE announcement was made by Greg Kroah-Hartman via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).