{"id":"CVE-2026-31518","title":"esp: fix skb leak with espintcp and async crypto","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with sy…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < aca3ad0c262f54a5b5c95dda80a48365997d1224","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 41aafca57de4a4c026701622bd4648f112a9edcd","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4820847e036ff1035b01b69ad68dfc17e7028fe9","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 6a3ec6efbc4f90e0ccb2e71574f07351f19996f4","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < df6f995358dc1f3c42484f5cfe241d7bd3e1cd15","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 88d386243ed374ac969dabd3bbc1409a31d81818","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 6aa9841d917532d0f2d932d1ff2f3a94305aaf47","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2","Linux 5.6"],"published":"2026-04-22","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:47:37.244Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31518","references":[{"url":"https://git.kernel.org/stable/c/aca3ad0c262f54a5b5c95dda80a48365997d1224"},{"url":"https://git.kernel.org/stable/c/41aafca57de4a4c026701622bd4648f112a9edcd"},{"url":"https://git.kernel.org/stable/c/4820847e036ff1035b01b69ad68dfc17e7028fe9"},{"url":"https://git.kernel.org/stable/c/6a3ec6efbc4f90e0ccb2e71574f07351f19996f4"},{"url":"https://git.kernel.org/stable/c/df6f995358dc1f3c42484f5cfe241d7bd3e1cd15"},{"url":"https://git.kernel.org/stable/c/88d386243ed374ac969dabd3bbc1409a31d81818"},{"url":"https://git.kernel.org/stable/c/6aa9841d917532d0f2d932d1ff2f3a94305aaf47"},{"url":"https://git.kernel.org/stable/c/0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02878,"ingestedAt":"2026-09-08T15:33:26.990Z","slug":"CVE-2026-31518","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error.\n\n## Affected\n\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < aca3ad0c262f54a5b5c95dda80a48365997d1224`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 41aafca57de4a4c026701622bd4648f112a9edcd`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4820847e036ff1035b01b69ad68dfc17e7028fe9`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 6a3ec6efbc4f90e0ccb2e71574f07351f19996f4`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < df6f995358dc1f3c42484f5cfe241d7bd3e1cd15`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 88d386243ed374ac969dabd3bbc1409a31d81818`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 6aa9841d917532d0f2d932d1ff2f3a94305aaf47`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}