CVE-2026-31518
Memory Leak in Linux Kernel ESP Module Due to Async Crypto Error
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 5.6 (inc) to 5.10.253 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's handling of ESP (Encapsulating Security Payload) with TCP and asynchronous cryptography. Specifically, when the transmission (TX) queue for espintcp is full, the function esp_output_tail_tcp returns an error but does not free the socket buffer (skb). In synchronous cryptography, the common xfrm output code drops the packet, but with asynchronous cryptography, the skb must be explicitly dropped when esp_output_tail_tcp returns an error. Failure to do so causes a memory leak of skb buffers.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel when using ESP with asynchronous cryptography. Over time, the leaked socket buffers (skb) can consume system memory, potentially degrading system performance or causing resource exhaustion. This could affect system stability and reliability, especially under high network load conditions.