CVE-2026-31518

Vulnerability

In the Linux kernel, a memory leak (skb leak) exists in the ESP (Encapsulating Security Payload) implementation when using TCP encapsulation (espintcp) with asynchronous cryptographic operations. The root cause is that when the TX queue for espintcp is full, the function esp_output_tail_tcp returns an error without freeing the socket buffer (skb). In the synchronous crypto path, the common xfrm output code handles the drop, but in the asynchronous path (esp_output_done), the skb was not freed, leading to a memory leak.

Exploitation

The vulnerability can be triggered by sending ESP packets over TCP (espintcp) when the TX queue becomes full, which can occur under high network load or with specific traffic patterns. The attack requires the ability to send IPsec ESP packets that use TCP encapsulation and asynchronous crypto (e.g., hardware offload). No special privileges are needed beyond network access to send such packets.

Impact

An attacker could cause a kernel memory leak by repeatedly triggering the condition, potentially leading to resource exhaustion and denial of service (system hang or crash). The CVSS score is 5.5 (Medium), indicating a moderate severity.

Mitigation

The fix was applied in the Linux kernel stable tree via commits [1][2][3][4] (backports to various stable versions). Users should update their kernel to include the fix. No workaround is mentioned.