Memory Leak in Linux Kernel ESP Module Due to Async Crypto Error

Publication date: 2026-04-22

Last updated on: 2026-04-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us. With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-22

Last Modified

2026-04-28

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31518

EUVD

EUVD-2026-24902

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 5.11 (inc) to 5.15.203 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.168 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.21 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.131 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.80 (exc)
linux	linux_kernel	From 5.6 (inc) to 5.10.253 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's handling of ESP (Encapsulating Security Payload) with TCP and asynchronous cryptography. Specifically, when the transmission (TX) queue for espintcp is full, the function esp_output_tail_tcp returns an error but does not free the socket buffer (skb). In synchronous cryptography, the common xfrm output code drops the packet, but with asynchronous cryptography, the skb must be explicitly dropped when esp_output_tail_tcp returns an error. Failure to do so causes a memory leak of skb buffers.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when using ESP with asynchronous cryptography. Over time, the leaked socket buffers (skb) can consume system memory, potentially degrading system performance or causing resource exhaustion. This could affect system stability and reliability, especially under high network load conditions.

Hi! I’m here to help you understand CVE-2026-31518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70