---
id: CVE-2026-31671
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm_user: fix info leak in build_report()

  struct xfrm_user_report is a __u8 proto field followed by a struct
  xfrm_selector which means there is three "empty" bytes of…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm_user: fix info leak in build_report()

  struct xfrm_user_report is a __u8 proto field followed by a struct
  xfrm_selector which means there is three "empty" bytes of…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.19.1, < 5.10.253'
  - 'linux_kernel >= 5.11, < 5.15.203'
  - 'linux_kernel >= 5.16, < 6.1.169'
  - 'linux_kernel >= 6.2, < 6.6.135'
  - 'linux_kernel >= 6.7, < 6.12.82'
  - 'linux_kernel >= 6.13, < 6.18.23'
  - 'linux_kernel >= 6.19, < 6.19.13'
  - linux_kernel = 2.6.19
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.13
published: '2026-04-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:16.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31671'
references:
  - url: 'https://git.kernel.org/stable/c/0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6c55714c931051cd7f4839c19ce0867179fd22fe'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/716c546e88cfe49d841658240e10cb57bc50a2cc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d10119968d0e1f2b669604baf2a8b5fdb72fa6b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d27c02eec529f78055a46a5c9e6c62684382b2d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e0c8542c3d097ed4205ded51868195d5d6ddac62'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ff5ee507302303b15859753c3e0d67d38fd12c88'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-082556.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.0012
epssPercentile: 0.01803
ingestedAt: '2026-09-08T15:33:26.989Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm_user: fix info leak in build_report()

struct xfrm_user_report is a __u8 proto field followed by a struct
xfrm_selector which means there is three "empty" bytes of padding, but
the padding is never zeroed before copying to userspace.  Fix that up by
zeroing the structure before setting individual member variables.

## Affected

- `linux_kernel >= 2.6.19.1, < 5.10.253`
- `linux_kernel >= 5.11, < 5.15.203`
- `linux_kernel >= 5.16, < 6.1.169`
- `linux_kernel >= 6.2, < 6.6.135`
- `linux_kernel >= 6.7, < 6.12.82`
- `linux_kernel >= 6.13, < 6.18.23`
- `linux_kernel >= 6.19, < 6.19.13`
- `linux_kernel = 2.6.19`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.13`