CVE record · CVE-2026-31663

xfrm: hold dev ref until after transport_finish NF_HOOK

CVSS 7.8 HighEPSS 0.0022 · 13th percentile

Published by the CVE Program (CNA: Linux) at 24 Apr 2026, 14:45 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected acf568ee859f098279eadf551612f103afdacb4e to before 4d06caedea587c59cc2cc893ceecc57c75c64312 git affected acf568ee859f098279eadf551612f103afdacb4e to before 94439cbe478b53f92223da9aae95fffb28623c3f git affected acf568ee859f098279eadf551612f103afdacb4e to before 4236c30b437b80f673b9e08c8fae38b8d471ac9e git affected acf568ee859f098279eadf551612f103afdacb4e to before 0f451b43c88bf2b9c038b414be580efee42e031b git affected acf568ee859f098279eadf551612f103afdacb4e to before 5002beda5cac69d522dc54da0d5d463ed9c963d2 git affected acf568ee859f098279eadf551612f103afdacb4e to before 1c428b03840094410c5fb6a5db30640486bbbfcb git affected 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f git affected 833760100588acfb267dac4d6a02ab9931237739 git affected e095ecaec6d94aa2156cceb98a85d409b51190f3 git affected 3.2.100 to before 3.3 semver affected 3.16.55 to before 3.17 semver affected 4.14.24 to before 4.15 semver Other versions: unaffected
Linux	Linux	affected 4.15 unaffected before 4.15 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.94 to 6.12., inclusive semver unaffected 6.18.23 to 6.18., inclusive semver unaffected 6.19.13 to 6.19., inclusive semver unaffected 7.0 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-31663
CNA: Linux
Weakness (CWE): CWE-416 · CWE-826
Tags: Linux kernel
Memory corruption
CWE-826
Published: 24 Apr 2026
Updated: 30 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.8	High	3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CNA (Linux)Used for this record
7.0	High	3.1	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	ADP (redhat-SADP)

CISA KEV Not listed.
EPSS 0.0022, the 13th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 24 Apr 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.