CVE-2026-31515

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families,

and that set_ipsecrequest() @family argument was truncated,

thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>

kernel BUG at net/core/skbuff.c:214 !

Call Trace:

<TASK>

skb_over_panic net/core/skbuff.c:219 [inline]

skb_put+0x159/0x210 net/core/skbuff.c:2655

skb_put_zero include/linux/skbuff.h:2788 [inline]

set_ipsecrequest net/key/af_key.c:3532 [inline]

pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636

km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848

xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705

xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References