CVE-2026-31671: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31671 is an information leak vulnerability in the Linux kernel's xfrm_user module, specifically in the build_report() function. The struct xfrm_user_report contains a __u8 proto field followed by a struct xfrm_selector, leaving three bytes of uninitialized padding that are copied to userspace without being zeroed, potentially exposing kernel memory contents. The vulnerability affects the Linux kernel from version 2.6.19 through multiple stable branches up to 7.0-rc7, with fixed versions available across all affected branches. It was disclosed on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-908 (Use of Uninitialized Resource) and CWE-401 (Missing Release of Memory after Effective Lifetime). In build_report(), when constructing a struct xfrm_user_report to send via the xfrm netlink interface, the three padding bytes between the __u8 proto field and the struct xfrm_selector are never explicitly zeroed before the structure is copied to userspace. An attacker with local access and low privileges can read these uninitialized bytes, which may contain residual kernel memory data. The fix zeroes the entire structure before populating individual member fields, preventing any stale memory from being exposed (GitHub Advisory).

Successful exploitation allows an unprivileged local attacker to read up to three bytes of uninitialized kernel memory per build_report() invocation via the xfrm netlink interface. While the direct data exposure per call is small, repeated exploitation could potentially leak sensitive kernel data such as cryptographic key material or memory layout information useful for ASLR bypass, enabling more sophisticated follow-on attacks. Availability and integrity are not directly impacted by this vulnerability (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a low probability of near-term exploitation. Exploitation requires local access with low privileges and the ability to interact with the xfrm netlink interface (GitHub Advisory).

Patches are available across all affected stable kernel branches. Administrators should upgrade to the following fixed versions or later: 5.10.253 (5.10.x branch), 5.15.203 (5.15.x branch), 6.1.169 (6.1.x branch), 6.6.135 (6.6.x branch), 6.12.82 (6.12.x branch), 6.18.23 (6.18.x branch), 6.19.13 (6.19.x branch), or Linux kernel 7.0 (stable). As a temporary workaround pending patching, restrict unprivileged access to xfrm/IPsec netlink interfaces where operationally feasible, though this may affect legitimate IPsec functionality. Systems exposing xfrm capabilities to untrusted local users should be prioritized for patching (GitHub Advisory, Red Hat Bugzilla).