{"id":"CVE-2026-31671","title":"xfrm_user: fix info leak in build_report()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < d27c02eec529f78055a46a5c9e6c62684382b2d8","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 716c546e88cfe49d841658240e10cb57bc50a2cc","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < e0c8542c3d097ed4205ded51868195d5d6ddac62","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < ff5ee507302303b15859753c3e0d67d38fd12c88","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 6c55714c931051cd7f4839c19ce0867179fd22fe","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72","Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < d10119968d0e1f2b669604baf2a8b5fdb72fa6b4","Linux 2.6.19"],"published":"2026-04-24","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:48:02.229Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31671","references":[{"url":"https://git.kernel.org/stable/c/d27c02eec529f78055a46a5c9e6c62684382b2d8"},{"url":"https://git.kernel.org/stable/c/716c546e88cfe49d841658240e10cb57bc50a2cc"},{"url":"https://git.kernel.org/stable/c/0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9"},{"url":"https://git.kernel.org/stable/c/e0c8542c3d097ed4205ded51868195d5d6ddac62"},{"url":"https://git.kernel.org/stable/c/ff5ee507302303b15859753c3e0d67d38fd12c88"},{"url":"https://git.kernel.org/stable/c/6c55714c931051cd7f4839c19ce0867179fd22fe"},{"url":"https://git.kernel.org/stable/c/0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72"},{"url":"https://git.kernel.org/stable/c/d10119968d0e1f2b669604baf2a8b5fdb72fa6b4"}],"tags":["cve.org"],"epss":0.0012,"epssPercentile":0.02077,"ingestedAt":"2026-09-08T15:33:26.989Z","slug":"CVE-2026-31671","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of padding, but\nthe padding is never zeroed before copying to userspace.  Fix that up by\nzeroing the structure before setting individual member variables.\n\n## Affected\n\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < d27c02eec529f78055a46a5c9e6c62684382b2d8`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 716c546e88cfe49d841658240e10cb57bc50a2cc`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < e0c8542c3d097ed4205ded51868195d5d6ddac62`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < ff5ee507302303b15859753c3e0d67d38fd12c88`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 6c55714c931051cd7f4839c19ce0867179fd22fe`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < 0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72`\n- `Linux >= 97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5 < d10119968d0e1f2b669604baf2a8b5fdb72fa6b4`\n- `Linux 2.6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}