CVE-2026-31515 af_key: validate families in pfkey_send_migrate()
A missing validation in the Linux kernel's af_key module allows a local attacker to trigger a kernel crash via a crafted IPsec migration request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31515?
CVE-2026-31515 is a medium-severity vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
af_key: validate families in pfkey_send_migrate()
syzbot was able to trigger a crash in skb_put() [1]
Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.
Validate families early, do not wait set_ipsecrequest().
[1]
skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150
Weakness: CWE-476
Which versions are affected by CVE-2026-31515?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31515?
Apply the vendor's patch.
Is CVE-2026-31515 being exploited?
There is no known exploitation of CVE-2026-31515 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83201, BELL-CVE-2026-31515, DEBIAN-CVE-2026-31515, GHSA-9285-5jpf-mwr6, ROOT-OS-DEBIAN-11-CVE-2026-31515, ROOT-OS-DEBIAN-12-CVE-2026-31515 and 4 more.