Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by Linux

CVE-2026-31671xfrm_user: fix info leak in build_report()

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.170-1DEBIAN-CVE-2026-31671
Debian:13linux6.12.85-1DEBIAN-CVE-2026-31671
Debian:14linux6.19.13-1DEBIAN-CVE-2026-31671
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-31671
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-31671
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1006.6UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-31671
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31671
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-31671
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-31671
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2026-31671

Affected products (as reported)

VendorProductVersions
Linux Linux 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before d27c02eec529f78055a46a5c9e6c62684382b2d897a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before 716c546e88cfe49d841658240e10cb57bc50a2cc97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before 0616314b3b34f24cbb91da8c6bd8bcdc4c8592f997a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before e0c8542c3d097ed4205ded51868195d5d6ddac6297a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before ff5ee507302303b15859753c3e0d67d38fd12c8897a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before 6c55714c931051cd7f4839c19ce0867179fd22fe97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before 0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb7297a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 – before d10119968d0e1f2b669604baf2a8b5fdb72fa6b4
Linux Linux 2.6.19

References