{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_iptfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1",
              "status": "affected",
              "version": "6be02e3e4f376fea468846c8562655ca5ee18204",
              "versionType": "git"
            },
            {
              "lessThan": "5784a1e2889c9525a8f036cb586930e232170bf7",
              "status": "affected",
              "version": "6be02e3e4f376fea468846c8562655ca5ee18204",
              "versionType": "git"
            },
            {
              "lessThan": "d849a2f7309fc0616e79d13b008b0a47e0458b6e",
              "status": "affected",
              "version": "6be02e3e4f376fea468846c8562655ca5ee18204",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_iptfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: only publish mode_data after clone setup\n\niptfs_clone_state() stores x-\u003emode_data before allocating the reorder\nwindow. If that allocation fails, the code frees the cloned state and\nreturns -ENOMEM, leaving x-\u003emode_data pointing at freed memory.\n\nThe xfrm clone unwind later runs destroy_state() through x-\u003emode_data,\nso the failed clone path tears down IPTFS state that clone_state()\nalready freed.\n\nKeep the cloned IPTFS state private until all allocations succeed so\nfailed clones leave x-\u003emode_data unset. The destroy path already\nhandles a NULL mode_data pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local NETLINK_XFRM configuration messages, including creating an IP-TFS ESP SA and triggering XFRM_MSG_MIGRATE cloning. It is not reached directly by remote packets.\nAC:L - The attacker controls the relevant XFRM/IP-TFS objects and can repeatedly trigger the clone failure path, including by using a large reorder window and memory pressure. There is no race requiring conditions outside the attacker\u0027s control, and uncertainty favors the higher severity option.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN in the target network namespace. Because this is reachable from an unprivileged user via user and network namespaces on systems that allow them, this is Low privileges rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker sends the needed netlink messages directly.\nS:U - The impact is within the kernel security authority on the same host. This is a standard local kernel memory corruption issue, not a boundary crossing such as guest-to-host escape.\nC:H - The bug leaves x-\u003emode_data pointing to freed IPTFS state and later dereferences it during destroy_state(), creating a use-after-free. Kernel UAFs are defensibly scored as high confidentiality impact because they can be shaped into memory disclosure primitives.\nI:H - The dangling IPTFS object is later used for locks, timers, queue teardown, skb freeing, and kfree operations, giving memory corruption and double-free style behavior. Kernel UAF memory corruption is defensibly scored as high integrity impact.\nA:H - The failed clone unwind can dereference freed memory and tear down already-freed IPTFS state, making kernel oops/panic or heap corruption likely. Any such kernel crash is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:50.697Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5784a1e2889c9525a8f036cb586930e232170bf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d849a2f7309fc0616e79d13b008b0a47e0458b6e"
        }
      ],
      "title": "xfrm: iptfs: only publish mode_data after clone setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31471",
    "datePublished": "2026-04-22T13:53:59.595Z",
    "dateReserved": "2026-03-09T15:48:24.098Z",
    "dateUpdated": "2026-08-05T12:22:50.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}