QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-31471

Back to search

CVE-2026-31471

Published: Apr 22, 2026

Modified: May 11, 2026

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_data before allocating the reorder window. If that allocation fails, the code frees the cloned state and returns -ENOMEM, leaving x->mode_data pointing at freed memory. The xfrm clone unwind later runs destroy_state() through x->mode_data, so the failed clone path tears down IPTFS state that clone_state() already freed. Keep the cloned IPTFS state private until all allocations succeed so failed clones leave x->mode_data unset. The destroy path already handles a NULL mode_data pointer.

VendorProductVersions

Linux

Linux

affected
6be02e3e4f376fea468846c8562655ca5ee18204 - < 371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1
affected
6be02e3e4f376fea468846c8562655ca5ee18204 - < 5784a1e2889c9525a8f036cb586930e232170bf7
affected
6be02e3e4f376fea468846c8562655ca5ee18204 - < d849a2f7309fc0616e79d13b008b0a47e0458b6e

Linux

Linux

affected
6.14
unaffected
0 - < 6.14
unaffected
6.18.21 - <= 6.18.*
unaffected
6.19.11 - <= 6.19.*
unaffected
7.0 - <= *

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now