CVE-2026-31515

What it actually does

This is a local denial-of-service flaw in the Linux kernel PF_KEY/IPsec migration path. The vulnerable function pfkey_send_migrate() fails to validate old and new address families before passing data into set_ipsecrequest(), where the family value can be truncated and cause an sk_buff buffer overrun. When triggered, the kernel hits skb_over_panic() / skb_put() bounds checks and raises a kernel BUG, typically resulting in a kernel crash or panic. The impact is availability loss; the issue does not directly provide confidentiality or integrity compromise based on the available details.

Why it matters to the business

A user or workload with sufficient local privileges to reach the affected IPsec/XFRM migration functionality could crash a Linux host, interrupting applications, network services, containers, or virtualized workloads running on that system. The CVSS score indicates moderate severity, EPSS is very low and stable, there is no known CISA KEV listing, no ransomware association, and no public exploit maturity reported, so broad internet-scale exploitation is unlikely; however, multi-user systems, shared compute platforms, and container hosts should still prioritize patching because a local crash can cause material service disruption.

How an attack unfolds

An attacker first needs local code execution or an account/workload on an affected Linux system, and in practice may need privileges such as CAP_NET_ADMIN or equivalent access to manipulate IPsec/XFRM state. The attacker then submits crafted migration parameters through the kernel IPsec/XFRM/PF_KEY interfaces using invalid or unexpected address-family values. Because the vulnerable code does not validate those families early, the kernel miscalculates or mishandles the size of data written into an sk_buff. The write exceeds the expected buffer boundary, the kernel detects the overflow in skb_put(), and the host triggers a kernel BUG/panic. Successful exploitation causes denial of service by crashing the affected system rather than giving the attacker direct code execution.

How to fix it

Update the Linux kernel to a vendor-maintained release that includes the upstream fix validating address families in pfkey_send_migrate(). Because exact fixed package versions were not provided, use the relevant distribution or appliance security advisory for the installed kernel branch and apply the fixed kernel package, then reboot into the patched kernel. Where immediate patching is not possible, reduce exposure by limiting local shell access, removing unnecessary CAP_NET_ADMIN privileges from containers and services, restricting untrusted workloads from network administration capabilities, using seccomp/AppArmor/SELinux profiles to reduce access to PF_KEY or XFRM-related operations where feasible, and disabling unused IPsec/PF_KEY functionality only if operationally safe and supported by the platform.

How to confirm the fix worked

Confirm that systems are no longer exposed by verifying the running kernel, not only the installed package. Check the active kernel with uname -r and compare it with the distribution advisory or vendor fixed release for this issue. Ensure systems have been rebooted after kernel package installation so the fixed kernel is active. Review container and service configurations to confirm untrusted workloads do not retain CAP_NET_ADMIN or broad network-administration privileges. Avoid running crash-triggering proof-of-concept tests on production systems; if validation testing is required, perform it only in an isolated lab and confirm that malformed PF_KEY/XFRM migration inputs are rejected rather than causing a kernel BUG or panic.

Typical attack path

1. Gain local access to an affected Linux system or run a workload/container with sufficient networking privileges.
2. Access kernel IPsec/XFRM/PF_KEY functionality, commonly requiring elevated local privileges such as CAP_NET_ADMIN.
3. Craft IPsec/XFRM migration inputs with invalid old/new address-family values.
4. Trigger the vulnerable pfkey_send_migrate() path.
5. Cause set_ipsecrequest() / skb_put() to overfill an sk_buff.
6. Crash the kernel through skb_over_panic() / kernel BUG, resulting in denial of service.

How to detect it

Look for evidence of prior exploitation in kernel and system logs rather than application logs. Relevant sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd journal entries from the kernel facility, crash dump records, kdump/vmcore metadata, hypervisor reset events, and endpoint telemetry showing kernel panic or unexpected reboot. Search for the specific crash path involving skb_over_panic, skb_put, set_ipsecrequest, pfkey_send_migrate, km_migrate, xfrm_migrate, xfrm_do_migrate, af_key, and XFRM. Correlate matching kernel crashes with local users, containers, or processes that had CAP_NET_ADMIN or performed IPsec/XFRM/PF_KEY operations shortly before the crash. In containerized environments, review auditd, Kubernetes/container runtime events, and EDR telemetry for workloads granted NET_ADMIN or privileged mode. There are no reliable network indicators because exploitation is local and targets kernel interfaces, but repeated unexplained crashes with the listed call trace are strong indicators of attempted exploitation or kernel fuzzing.

• skb_over_panic
• kernel BUG at net/core/skbuff.c:214
• skb_put+0x159/0x210
• skb_put_zero include/linux/skbuff.h
• set_ipsecrequest net/key/af_key.c
• pfkey_send_migrate
• km_migrate net/xfrm/xfrm_state.c
• xfrm_migrate net/xfrm/xfrm_policy.c
• xfrm_do_migrate net/xfrm/xfrm_user.c
• skbuff: skb_over_panic
• tail:0x188 end:0x180
• dev:<NULL>
• net/key/af_key.c:3636
• net/key/af_key.c:3532

What your security team should do

• Inventory Linux systems, especially multi-user hosts, container hosts, VPN/IPsec gateways, and systems running workloads with CAP_NET_ADMIN.
• Patch affected kernels using the appropriate distribution or vendor security update, then reboot to activate the fixed kernel.
• Prioritize shared compute, container orchestration nodes, bastion hosts, developer workstations with untrusted local users, and IPsec-heavy systems even though EPSS is low and the issue is not in CISA KEV.
• Temporarily restrict local access and remove unnecessary CAP_NET_ADMIN or equivalent privileges from containers, services, and user accounts until patching is complete.
• Monitor kernel logs for skb_over_panic, pfkey_send_migrate, xfrm_migrate, and related crash signatures that may indicate attempted exploitation or fuzzing.
• Review recent unexplained Linux host crashes or kernel panics since publication for matching call traces.
• Track vendor advisories for exact fixed kernel package versions because no universal fixed version was provided in the input.