VulnerabilityPublished 24 Apr 2026Updated 6 Nov 2026

CVE-2026-31664: Linux kernel · xfrm: clear trailing padding in build_polexpire()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in eda30846ea54f8ed218468e5480c8305ca645e37 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 15:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in eda30846ea54f8ed218468e5480c8305ca645e37, e6f4ffe8596947a595c9544e73a73adcb0568b88, e1af65c669ebb1666c54576614c01a7f9ffcfff6 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < eda30846ea54f8ed218468e5480c8305ca645e37	Fixed in eda30846ea54f8ed218468e5480c8305ca645e37
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e6f4ffe8596947a595c9544e73a73adcb0568b88	Fixed in e6f4ffe8596947a595c9544e73a73adcb0568b88
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e1af65c669ebb1666c54576614c01a7f9ffcfff6	Fixed in e1af65c669ebb1666c54576614c01a7f9ffcfff6
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c221ed63a2769a0af8bd849dfe25740048f34ef4	Fixed in c221ed63a2769a0af8bd849dfe25740048f34ef4
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b1dfd6b27df35ef4f87825aa5f607378d23ff0f2	Fixed in b1dfd6b27df35ef4f87825aa5f607378d23ff0f2
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ac6985903db047eaff54db929e4bf6b06782788e	Fixed in ac6985903db047eaff54db929e4bf6b06782788e

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire. The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents. Add the missing memset_after() call, matching build_expire().

References

Community reviews

Loading reviews…