LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31471: xfrm: iptfs: only publish mode_data after clone setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_data before allocating the reorder window. If that allocation fails, the code frees the cloned state and returns -ENOMEM, leaving x->mode_data pointing at freed memory. The xfrm clone unwind later runs destroy_state() through x->mode_data, so the failed clone path tears down IPTFS state that clone_state() already freed. Keep the cloned IPTFS state private until all allocations succeed so failed clones leave x->mode_data unset. The destroy path already handles a NULL mode_data pointer.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel memory-safety flaw affects IPTFS state cloning. When memory allocation fails, the kernel can retain a pointer to already-freed data and later destroy it again. The supplied CVSS rating is 7.8 (High), with potential confidentiality, integrity, and availability impact. Exploitation requires local access and low privileges according to the supplied vector.

Executive priority

Treat as a high-priority kernel maintenance issue, especially on multi-user or shared Linux systems using IPTFS/XFRM. It does not warrant the urgency of a confirmed remotely exploited vulnerability based on current evidence. Patch through supported distribution channels and verify the running kernel, while tracking vendor clarification of the unusual affected-version data.

Technical view

iptfs_clone_state() published cloned IPTFS state through x->mode_data before completing reorder-window allocation. An allocation failure freed that state but left the published pointer dangling. Later XFRM clone cleanup called destroy_state() through the stale pointer, operating on previously freed memory. The fix delays publishing mode_data until every clone allocation succeeds.

Likely exposure

Exposure is limited to Linux systems containing the affected IPTFS/XFRM implementation and capable of reaching the failed clone path. The bundle lists 6.14, 6.18.21, 6.19.11, and 7.0 as affected, but also includes an unexplained “0” and unclear range semantics. Confirm exact exposure against distribution kernel advisories and backports.

Exploitation context

The supplied CVSS vector indicates a local, low-complexity attack requiring low privileges and no user interaction. The bundle does not establish remote exploitation. This CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public proof of concept.

Researcher notes

The failure is a stale-pointer cleanup bug created by publishing partially initialized clone state. The supplied record names three stable-kernel fix commits but provides no CWE, exploit evidence, reachability prerequisites beyond CVSS, or clear version-range interpretation. Researchers should distinguish upstream versions from distribution builds carrying backports and avoid inferring exploitability solely from the CVSS impact values.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the applicable stable fix or backport.
  • Check distribution advisories because packaged kernel versions may contain backported fixes.
  • Prioritize systems using IPTFS/XFRM functionality and permitting access by untrusted local users.
  • If immediate patching is impossible, follow vendor guidance for safely limiting affected functionality.

Validation and detection

  • Inventory deployed kernel builds and identify the exact vendor package and patch level.
  • Confirm the kernel source or vendor changelog includes an applicable referenced fix commit.
  • Determine whether IPTFS/XFRM functionality is present and operationally used on each system.
  • After updating, verify the running kernel matches the remediated package following reboot.
  • Monitor vendor advisories for clarified affected-version ranges and additional stable backports.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31471 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31471Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6be02e3e4f376fea468846c8562655ca5ee18204, 6be02e3e4f376fea468846c8562655ca5ee18204, 6be02e3e4f376fea468846c8562655ca5ee18204unaffected
LinuxLinux6.14, 0, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.