CVE-2026-31517

Vulnerability

CVE-2026-31517 is a denial-of-service vulnerability in the Linux kernel's IP-TFS (IPsec Traffic Flow Security) reassembly logic within the xfrm subsystem. The bug resides in iptfs_reassem_cont(), where the code attempts to append data to a reassembled skb using skb_put(). If a previous fragment was handled via a zero-copy fast path, the skb becomes non-linear. When a subsequent fragment requires a memory copy, the call to skb_put() triggers an SKB_LINEAR_ASSERT check, causing a kernel panic (Oops: invalid opcode) [1].

Exploitation

An attacker can trigger this vulnerability by sending a crafted sequence of IP-TFS fragments that cause the reassembly process to intermix zero-copy and copy operations. No authentication is required if the system processes IPsec traffic with IP-TFS enabled. The attack vector is network-based, and the attacker must be able to send malicious fragmented datagrams to the target. The bug is reachable from the network stack via iptfs_input_ordered and xfrm_input [2].

Impact

Exploitation results in a kernel panic, leading to a denial of service (system crash). The CVSS v3 base score is 5.5 (Medium), indicating a moderate impact with high availability impact but no confidentiality or integrity loss. The vulnerability can be used to crash the system, disrupting network services.

Mitigation

The fix, committed in the Linux kernel stable tree, adds a check for non-linear skbs in iptfs_reassem_cont(). If the skb is non-linear, it is linearized via skb_linearize() before calling skb_put() [3]. Users should apply the corresponding stable kernel updates to their systems. No workaround is available; the only mitigation is to apply the patch.