CVE-2026-31664: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire. The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents. Add the missing memset_after() call, matching build_expire().

Affected products

• Linux Linux Kernel: from 2.6.12.1, before 6.1.169 (fixed in 6.1.169); from 6.2, before 6.6.135 (fixed in 6.6.135); from 6.7, before 6.12.82 (fixed in 6.12.82); from 6.13, before 6.18.23 (fixed in 6.18.23); from 6.19, before 6.19.13 (fixed in 6.19.13); version 2.6.12 only; …

Published 2026-04-24. Last modified 2026-07-14.