CVE-2026-31515 - Vulnerability Details

- af_key: validate families in pfkey_send_migrate()

Description

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families,
and that set_ipsecrequest() @family argument was truncated,
thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>
kernel BUG at net/core/skbuff.c:214 !
Call Trace:
<TASK>
skb_over_panic net/core/skbuff.c:219 [inline]
skb_put+0x159/0x210 net/core/skbuff.c:2655
skb_put_zero include/linux/skbuff.h:2788 [inline]
set_ipsecrequest net/key/af_key.c:3532 [inline]
pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636
km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848
xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705
xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

Published: 2026-04-22

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A missing check for family values in the Linux kernel’s pfkey_send_migrate() routine allows truncated arguments to over‑fill a socket buffer. The resulting buffer overflow triggers a BUG in skb_put(), causing a kernel panic. This crash leads to a complete system shutdown, but does not provide a path to escape privilege limits.

Affected Systems

All Linux kernel releases before the commit that adds early family validation to af_key are affected. The kernel change is part of upstream development and applies to mainstream distributions that ship the original kernel code.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity while the EPSS score of less than 1% points to a low probability of exploitation. Local users who can send crafted PF_KEY requests—such as administrators manipulating IPsec configurations—can trigger the crash. The attack does not have a wide spread exploitation presence and is not listed in CISA KEV, but the denial of service impact mandates prompt patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< d0c5aa8dd38887714f1aad04236a3620b56a5e4e
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< e06b596fc4eb01936a2e5dccad17c946d660bab8
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< 8ddf8de7e758f6888988467af9ffc8adf589fb16
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< d3225e6b9bd51ec177970a628fe4b11237ce87d5
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< 7b18692c59afb8e5c364c8e3ac01e51dd6b52028
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< 83f644ea92987c100b82d8481ae2230faeed3d34
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< ee836e820a40e2ca4da8af7310bff92d586772d4
`08de61beab8a21c8e0b3906a97defda5f1f66ece`	affected	< eb2d16a7d599dc9d4df391b5e660df9949963786

Linux

affected

Version	Status	Constraints
`2.6.21`	affected	—
`0`	unaffected	< 2.6.21
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.21:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,d0c5aa8dd38887714f1aad04236a3620b56a5e4e)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,e06b596fc4eb01936a2e5dccad17c946d660bab8)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,8ddf8de7e758f6888988467af9ffc8adf589fb16)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,d3225e6b9bd51ec177970a628fe4b11237ce87d5)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,7b18692c59afb8e5c364c8e3ac01e51dd6b52028)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,83f644ea92987c100b82d8481ae2230faeed3d34)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,ee836e820a40e2ca4da8af7310bff92d586772d4)`	affected	code_commit	—
`[08de61beab8a21c8e0b3906a97defda5f1f66ece,eb2d16a7d599dc9d4df391b5e660df9949963786)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.21`	affected	semver	—
`[0,2.6.21)`	unaffected	generic	—
`[5.10.253,5.11.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the af_key family validation fix
Restrict access to PF_KEY sockets to trusted or privileged users only
Apply any available vendor backport or security patch for the kernel in the meantime, or temporarily disable IPsec/PF_KEY features that could trigger the bug until a patch is released

Generated by OpenCVE AI on April 28, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028
https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34
https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16
https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e
https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5
https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8
https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786
https://git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4
https://lore.kernel.org/linux-cve-announce/2026042210-CVE-2026-31515-d929@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31515
https://www.cve.org/CVERecord?id=CVE-2026-31515

History

Tue, 28 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.21:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 23 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026042210-CVE-2026-31515-d929@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31515 https://www.cve.org/CVERecord?id=CVE-2026-31515
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
Title		af_key: validate families in pfkey_send_migrate()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028 https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34 https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16 https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5 https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8 https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786 https://git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-22T13:54:32.194Z

Updated: 2026-05-11T22:10:17.324Z

Reserved: 2026-03-09T15:48:24.107Z

Link: CVE-2026-31515

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-22T14:16:50.940

Modified: 2026-04-28T16:20:43.873

Link: CVE-2026-31515

Redhat

Severity : Moderate

Publid Date: 2026-04-22T00:00:00Z

Links: CVE-2026-31515 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T21:00:14Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object