Information Leak in Linux Kernel's XFRM User Interface

CVE-2026-31671

What is CVE-2026-31671?

A vulnerability in the Linux kernel's xfrm_user interface allows uninitialized padding bytes to be exposed in user space. This can lead to unintended information disclosure, which might expose sensitive data. The issue arises from a failure to zero out the padding of the struct xfrm_user_report before copying it to user space, potentially allowing attackers to read data from memory that they should not have access to. A fix has been introduced to ensure the structure is properly zeroed, enhancing the security of the kernel.

References