ZeroDay Findings
Sign inSign up

Findings

CVE-2026-31671

In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed b…

Published Apr 24, 2026 · updated Oct 15, 2026 · linux linux kernel

In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2026 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables.

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed before copying to userspace. Fix that up by zeroing the structure before setting individual member variables.

Affected

  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel2.6.19

Sources

  • CVE.orgVulnerability recordCVE-2026-31671

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-31671

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-31671

    In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report is a __u8 proto field followed by a struct xfrm_selector which means there is three "empty" bytes of padding, but the padding is never zeroed b

    nvd.nist.gov

References

CVE-2026-31671 · ZeroDay Findings