Medium 5.5Published Apr 22, 2026

CVE-2026-31515af_key: validate families in pfkey_send_migrate()

Updated under an hour ago (Oct 28, 2026, 8:10 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 08de61beab8a21c8e0b3906a97defda5f1f66ece before d0c5aa8dd38887714f1aad04236a3620b56a5e4e; from 08de61beab8a21c8e0b3906a97defda5f1f66ece before e06b596fc4eb01936a2e5dccad17c946d660bab8; 08de61beab8a21c8e0b3906a97defda5f1f66ece builds before 8ddf8de7e758f6888988467af9ffc8adf589fb16; from 08de61beab8a21c8e0b3906a97defda5f1f66ece before d3225e6b9bd51ec177970a628fe4b11237ce87d5; 08de61beab8a21c8e0b3906a97defda5f1f66ece builds before 7b18692c59afb8e5c364c8e3ac01e51dd6b52028; from 08de61beab8a21c8e0b3906a97defda5f1f66ece before 83f644ea92987c100b82d8481ae2230faeed3d34; from 08de61beab8a21c8e0b3906a97defda5f1f66ece before ee836e820a40e2ca4da8af7310bff92d586772d4; from 08de61beab8a21c8e0b3906a97defda5f1f66ece before eb2d16a7d599dc9d4df391b5e660df9949963786	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.21.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 2.6.21; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e	patch
https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8	patch
https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16	patch
https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5	patch
https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028	patch
https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34	patch
https://git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4	patch
https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.