CVE-2026-31663
Linux Kernel 3.2.100 – 3.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-31663 is a high-severity Premature Release of Resource During Expected Lifetime (CWE-826) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31663 is a vulnerability in the Linux kernel's xfrm subsystem, which handles IPsec processing. The issue arises in the xfrm_input_resume() function during async cryptography completion, where dev_put() is called too early on the skb->dev reference before the skb reaches transport_finish and its NF_HOOK call. This creates a race condition with device teardown, as the skb->dev pointer is still accessed in NF_HOOK and its okfn (including NF_DROP, NF_QUEUE, and NF_STOLEN paths), potentially leading to use-after-free or invalid memory access. The vulnerability affects Linux kernel versions prior to the application of the referenced stable patches.
A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability without user interaction (UI:N) in a single-instance scope (S:U). Successful exploitation could result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 7.8. The attacker would need access to a system running a vulnerable kernel and likely trigger the xfrm input path via IPsec traffic processing.
Mitigation involves applying the upstream kernel patches from the provided stable commit references: https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b, https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb, and https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2. These commits adjust the device reference handling by deferring dev_put() until after NF_HOOK in transport_finish using a saved device pointer, while releasing references inline for other async exit paths like decaps, GRO, or drops. Security practitioners should update to a kernel version incorporating these fixes and monitor for systems using IPsec/xfrm features.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25556
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside…
more
NF_HOOK and its okfn, which can race with device teardown. Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn. For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover premature-release defects before deployment.
Engineering principles can require correct resource lifetime management so the premature-release pattern is never coded.
Process isolation confines the blast radius when a resource is released while still referenced inside another domain.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect premature-release bugs, providing partial mitigation.
Secure development lifecycle practices can include resource-lifetime checks that reduce premature-release defects.
Application security requirements can mandate explicit resource-release rules, partially addressing the weakness.
Secure architecture principles encourage proper resource scoping and lifetime management.
Secure coding standards directly prohibit premature resource release, covering most of the weakness.
Change-management processes may catch resource-handling regressions but do not directly prevent the weakness.