CVE-2026-31517
Memory Corruption in Linux Kernel xfrm_iptfs Causes skb_put() Panic
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.14 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.14.1 (inc) to 6.18.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's IP-TFS (IP Transport Flow Security) reassembly code. Specifically, during the reassembly of fragmented packets, the function iptfs_reassem_cont() tries to append data to a new inner packet called 'newskb'. Initially, a zero-copy approach is used which makes 'newskb' non-linear.
If a subsequent fragment does not meet certain fast-path conditions, a memory copy is performed and skb_put() is called to append data. However, because 'newskb' is non-linear at this point, calling skb_put() triggers a kernel panic due to the SKB_LINEAR_ASSERT check failing.
The fix involves checking if 'newskb' is non-linear and, if so, linearizing it by calling skb_linearize() before appending data. This prevents the kernel panic and ensures safe packet reassembly.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic (system crash) when processing certain fragmented network packets. Such a crash can lead to denial of service (DoS) conditions, making the affected system unstable or unavailable until it is rebooted.
An attacker could potentially exploit this by sending specially crafted fragmented packets to trigger the panic, disrupting network services or causing downtime.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that when the skb (socket buffer) is non-linear during IP-TFS packet reassembly, it is linearized by calling skb_linearize().
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix, which prevents the skb_put() panic by properly handling non-linear skbs during reassembly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel panic caused by a skb_put() call on a non-linear skb during IP-TFS packet reassembly. Detection involves monitoring your system logs for kernel oops or panic messages referencing skb_put, iptfs_reassem_cont, or related stack traces.
You can check your kernel logs for relevant error messages using commands like:
- dmesg | grep -i 'skb_put'
- journalctl -k | grep -i 'iptfs_reassem_cont'
- grep -i 'invalid opcode' /var/log/kern.log
Additionally, monitoring for unexpected kernel panics or crashes related to network packet processing may indicate exploitation attempts.