CVE-2026-31664 PUBLISHED

xfrm: clear trailing padding in build_polexpire()

Assigner: Linux
Reserved: 09.03.2026 Published: 24.04.2026 Updated: 24.04.2026

In the Linux kernel, the following vulnerability has been resolved:

xfrm: clear trailing padding in build_polexpire()

build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogous function build_polexpire() does not do this for struct xfrm_user_polexpire.

The padding bytes after the __u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners, leaking kernel heap memory contents.

Add the missing memset_after() call, matching build_expire().

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to ac6985903db047eaff54db929e4bf6b06782788e (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to c221ed63a2769a0af8bd849dfe25740048f34ef4 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to eda30846ea54f8ed218468e5480c8305ca645e37 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to b1dfd6b27df35ef4f87825aa5f607378d23ff0f2 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to e1af65c669ebb1666c54576614c01a7f9ffcfff6 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 71a98248c63c535eaa4d4c22f099b68d902006d0 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.12 is affected
  • unaffected from 0 to 2.6.12 (excl.)
  • unaffected from 6.1.169 to 6.1.* (incl.)
  • unaffected from 6.6.135 to 6.6.* (incl.)
  • unaffected from 6.12.82 to 6.12.* (incl.)
  • unaffected from 6.18.23 to 6.18.* (incl.)
  • unaffected from 6.19.13 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References