CVE-2026-31664

Vulnerability

In the Linux kernel's XFRM (IPsec) subsystem, the function build_polexpire() constructs a struct xfrm_user_polexpire message to notify userspace of a policy expiration. Unlike the analogous build_expire() function, build_polexpire() fails to clear the trailing padding bytes after the __u8 hard field using memset_after(). As a result, these padding bytes remain uninitialized, containing leftover kernel heap memory.

Exploitation

The uninitialized padding is transmitted to userspace via netlink multicast to the XFRMNLGRP_EXPIRE group. Any process that can receive netlink messages on this multicast group—typically local users with appropriate privileges or access to the netlink socket—can capture the leaked heap data. No authentication or special network position is required beyond the ability to listen for netlink events.

Impact

An attacker can read kernel heap memory contents, potentially disclosing sensitive information such as cryptographic keys, process credentials, or other data present in the heap at the time of allocation. This information disclosure (CWE-200) has a CVSS v3 base score of 5.5 (Medium).

Mitigation

The fix, introduced in the Linux kernel stable tree, adds the missing memset_after() call to build_polexpire(), matching the behavior of build_expire() [1]. Users should update to a kernel version containing this commit or apply the corresponding stable backport. No workaround is available; patching is required.